Pulls out common logic from decorator and mixin, and adds check for configuration

I realize that I was mistaken in thinking you could use `hasattr()` here, since the object in question is a dictionary.  This is fine, but I can also see how something like `if not request.session.get('LTI_LAUNCH', None):` makes sense here.  Another Python practice I've read about is to be more liberal with try/catch blocks, so I could also see where you might wrap a try/catch block around where the user_roles variable is set, and if you get a KeyError you'd raise the ImproperlyConfigured exception.