Do not give course edition coordinators the "create" permission.
As described in the CanCanCan documentation, calling
can? :create, CourseEdition does not check conditions specified in the ability file, but only checks if the user has the "create" permission on at least one course edition (which they do as they have been granted the "manage" permission on a course edition).
There is a chance this issue may exist in other places in the application as well, as I noticed similar calls to
can? with a class passed as the argument.
Closes #286 (closed)