Deny self-service certificates for anonymous users

@jbau this is now the real version of this that replaces https://github.com/edx/edx-platform/pull/4065. 

Bugfix for the following condition:
When anonymous (e.g., non-registered) access is enabled for a course,
and that course also uses the /request_certificate endpoint (e.g., via
the "Grade Me" button), anonymous users could request to be graded and
given certificates.

As a matter of policy, Stanford doesn't want to give certificates to
anonymous students.

Also adds defensive error checks in several more places.
can you hold on and make sure this is OpaqueKeys compliant?  I think this sort of thing is changing.