'Test that auth restricts get and delete appropriately'

@ddt.data(ModuleStoreEnum.Type.split, ModuleStoreEnum.Type.mongo)
def test_not_permitted(self, default_store):

    course = self.create_course_with_orphans(default_store)
    orphan_url = reverse_course_url('orphan_handler', course.id)
    (test_user_client, test_user) = self.create_non_staff_authed_user_client()
    CourseEnrollment.enroll(test_user, course.id)
    response = test_user_client.get(orphan_url)
    self.assertEqual(response.status_code, 403)
    response = test_user_client.delete(orphan_url)
    self.assertEqual(response.status_code, 403)
