I may have figured this out, as well as I can.
For paypal to work, I need to go to: Site administration -> Plugins -> Authentication
Set "Email-based self-registration" to "enable" by clicking that eye icon.
Then, lower down on the page, there is a drop-down menu where "Self registration" must be set to "enable. "
This seems redundant to me. If I enable "Email-based self-registration" then I clearly want students to be able to self-register. Why must set "Self registration" have to be set to "enable" in that drop-down menu?
If an unregistered user clicks on a course to take, from the landing page, then that user will be taken to paypal to be pay to enrol in the course, and register on the site.
But, if an unregistered user clicks on the (log in) link on the upper right corner of the landing page, then the user will be able to register on the site, but not be able enrol in any of the pay courses without going through paypal. This, I assume, is how the Russian guy registered.
This is not exactly what I want. I only want users to be able to register if they are buying a course. The free courses require no registration, they have guest access, which is granted automatically.
But, I suppose there is no harm to having somebody register as a student, as long as I hide all the information from other users.