1. Give a short description of the bug The "New Course Edition" button on the `/admin/courses/{id}` page is shown to all coordinators: permissions are configured improperly. 2. Explain the steps you took to trigger the bug I gave a user who is not a programme coordinator a course edition coordinator role, logged in as that user, and navigated to the course management page. 3. What is the *expected* behavior? The "New Course Edition" button is not shown. 4. What is the *actual* behavior? The "New Course Edition" button is displayed and leads to a 403 Forbidden page.