A customer reported that the "Reindex" course shows up but when clicking it, a 403 Forbidden error shows up.
How to Reproduce
Create register a new normal user.
Add that user as a course staff while setting `user.is_staff` to `False`
Click on the "Reindex" button
*Expected:* To index the course, or at least the button wouldn't show up.
*Actual:* The button shows up but clicking on it gives a 403 forbidden error.
This pull request allows course staff to reindex the course.
Why not Hiding the Button?
Because re-indexing the course looks safe enough to trust course staff to do it, it accepts a course key and can't do anything other than re-indexing. Besides, there's not much of global staff in multi-tenant environments.