Break out LTI launch url into a separate view that is exempt from csrf, requires login, and redirects to the main index view.  Add tests, new url, and update tool config to point to this new entry point.