We want to allow staff to see all courses in the LMS.
This changes the behavior from staff being treated like
an AnonymousUser (unless an username query parameter is
provided) to being treated like staff.

I also added in some tests for the other paths in this
function that did not seem to be tested.