Permission issue

[lxylxy123456]

This problem happens after #18
Consider the API /api/assignments/<course_id>.
If we have one class ECS123, and a student not taking this class
Then for this user, /api/assignments/ECS123 returns "permission denied", and /api/assignments/ECS124 returns "course not found"

So any user who can access the service can list all courses using brute force.
Is this a problem?

[Lawrence37]

In the nbgrader exchange directory, everyone has read access to the courses and even the assignments.

[lxylxy123456]

I see. So I will say that either the exchange folder design is not very secure or I am overthinking. I usually think about this when making a website backend. Maybe we can let Kevin comment on this after he joins this repo.