Add tests for permissions

[lastmjs]

Figure out good tests for permissions. The following is a start:

• Public questions should be visible by anyone
• Course questions should be visible only within a course
• Author can always see questions