         @sendCreated(res, courseInstance)
 
   addMember: (req, res, courseInstanceID) ->
+    return @sendUnauthorizedError(res) if not req.user?
     userID = req.body.userID
     return @sendBadInputError(res, 'Input must be a MongoDB ID') unless utils.isID(userID)
     CourseInstance.findById courseInstanceID, (err, courseInstance) =>

                @sendSuccess(res, @formatEntity(req, courseInstance))

  removeMember: (req, res, courseInstanceID) ->
    userID = req.body.userID
    return @sendBadInputError(res, 'Input must be a MongoDB ID') unless utils.isID(userID)
    CourseInstance.findById courseInstanceID, (err, courseInstance) =>

            @sendSuccess(res, courseInstances)

  findByLevel: (req, res, levelOriginal) ->
    return @sendUnauthorizedError(res) if not req.user?
    # Find all CourseInstances that req.user is a part of that match the given level.
    CourseInstance.find {_id: {$in: req.user.get('courseInstances')}},  (err, courseInstances) =>
      return @sendDatabaseError res, err if err
