Record exercise results only from the grading endpoint

A learner could write their own status and test results through the document API. The controller now rejects writes that do not come from the grading endpoint.