Add verification of educator identity for class roster endpoint

[Carifio24]

Something that we probably want is some way to verify that the request is coming from the educator in charge of the class - maybe pass some identifying tag for the educator in a header or something?

I don't think it's pressing since the API is not publicly usable (as we don't currently give out keys), but that may change someday.

Originally posted by @Carifio24 in #137 (comment)