don’t throw PermissionDenied if there is no LTI data in the request; this is to allow view-by-view authentication