multisession

[arthurian]

This PR adds support for maintaining session across multiple LTI launches. This will allow a user to launch several instances of the tool and interact with them like they would expect.

Notes:

• Added middleware that takes responsibility for validating and maintaining the session dictionary of each LTI launch (capped at 10 launches per user). This is included after the cookieless middleware.
• Each LTI launch is identified by the resource_link_id associated with the tool placement, which should be unique across contexts.
• Since only the initial POST request includes the resource_link_id, subsequent requests that would like to access the launch session data will need to include the resource_link_id as a GET parameter. This required modifying most template url tags and redirect() view functions.
• Added request.LTI which is a dict-like object that handles access to the appropriate session entry via request.session['LTI_LAUNCH'][resource_link_id]. It also adds better error messages in cases where the resource_link_id is missing, or the launch data is missing for some reason.

Usage:

In views that require launch-specific session data (most views in the app), they will use request.LTI instead of request.session. This is a shortcut method for accessing the proper session dictionary. Instead of this:

resource_link_id = request.GET.get('resource_link_id')
is_staff = request.session['LTI_LAUNCH'][resource_link_id]['is_staff']

We can simply do this:

is_staff = request.LTI['is_staff']