Further minor refactor of LTI/OAuth stuff

I've moved most of the key stuff into a single utility class
to make it easier to test/debug things.