'Unauthorized users should get an empty list.'

def test_not_authorized(self):

    user = StaffFactory(course_key=self.course.id)
    access_token = AccessTokenFactory.create(user=user, client=self.oauth_client).token
    auth_header = ('Bearer    ' + access_token)
    response = self.http_get(reverse(self.view), HTTP_AUTHORIZATION=auth_header)
    self.assertEqual(response.status_code, 200)
    url = '{}?course_id={}'.format(reverse(self.view), self.course_id)
    response = self.http_get(url, HTTP_AUTHORIZATION=auth_header)
    self.assertEqual(response.status_code, 200)
    data = response.data['results']
    self.assertEqual(len(data), 1)
    self.assertEqual(data[0]['name'], self.course.display_name)
    url = '{}?course_id={}'.format(reverse(self.view), unicode(self.empty_course.id))
    response = self.http_get(url, HTTP_AUTHORIZATION=auth_header)
    self.assertEqual(response.status_code, 200)
    self.assertDictContainsSubset({'count': 0, u'results': []}, response.data)
