Limit onboarding lookups to managers and whitelist the batch one

Restricts the first-course and first-batch lookups to System Managers and Moderators, and whitelists the batch lookup so its step stops returning 403.