From the video it seems they had instructor's access. But in the real life they could save a draft and view it a student to see if they can hijack the session.

From the video it seems they had instructor's access. But in the real life they could save a draft and view it a student to see if they can hijack the session. Another perhaps lesson - if security really matters - perhaps instructors and students should have completely different decoupled apps to do the job. (security through obscurity)