when authenticating the user, put all of the LTI launch params into a dict called LTI_LAUNCH in the session

middleware will process all LTI launch requests, regardless of whether or not the user is already logged in.

when extracting the userid from the LTI launch request, look for lis_person_sourcedid first, then custom_canvas_user_login_id, then user_id

don’t throw PermissionDenied if there is no LTI data in the request; this is to allow view-by-view authentication

Handle case where the SIS user id isn’t available in the LTI request; handle missing email/first_name/last_name