Reauthentication needs session clear

[jolyonb]

When a user successfully logs into an LTI session, pyLTI currently assumes that they want to remain logged into this session until the session cookie expires. If they attempt to log into another session with different credentials, those new credentials are not checked. This means that old credentials can be passed into an application.