Client downloads correct answers for unanswered questions; enables cheating.

[LaserBread]

I found a pretty severe oversight in the server-client communication of Open Response. When the client requests a question stem, the server will send the correct answers for every question in the lecture even if the student hasn't answered the questions. This means a student with even somewhat basic knowledge of the web console could cheat on multiple-choice questions.

To Reproduce
Steps to reproduce the behavior:

1. Log in as a student
2. Go to any unanswered question
3. Open the networking tab on the dev console
4. Select the GET request that is just a number.
5. In the tree view of the response object, expand the questions property.
6. Expand the numbered property corresponding to the index of the question you want to get the correct answer for
7. Expand the answers property.

Expected behavior
The client should not request the correct answer unless the question was answered (ie, a response associated with this student exists). Because of this, a separate GET request would be made for the correct answers, to which the server responds with HTTP 403 if the student hasn't answered the question (or the teacher decides to have correct answers hidden if we add this feature).

Screenshots