fix a bug in lti authorize
add user_id to lti_launch and prevent cross account user lookup