Minor tidy to candidate session access code
Fix to UQ runner following live test of beta6

The recent changes to candidate session access did not work when I tried
on UQ after deploying beta6. (Unfortunately can only test UQ on the
production QTIWorks at present.)

The problem here is that UQ does not pass on the cookie that's sent back
from QTIWorks, so a second HTTP session gets created when the
candidate's browser accesses the redirect sent back from QTIWorks.

I have fixed this by adding a further step to launch to make sure that
the candidate session doens't get created until control has passed to
QTIWorks. This initial step uses a link to the Delivery that was
initially created, with a simple SHA1 digest added to the URL to make it
difficult (but not impossible) to hijack the launch.
Merge branch 'master' into production