Fixed the destroy session logic.

1. an exercise_id is provided ==> only the LtiParameter object for the current user, consumer, and exercise is deleted.
2. no exercise_id is provided ==> external user and consumer are removed from the session, all LtiParameter objects for this user and consumer are deleted.

This enables users to have several tabs with exercises open and submitting the results to the tool consumer.
When an exercise has been submitted, the user cannot use the back button to get back to CodeOcean and work on the submitted or any other exercise.
For now a warning has been added to the info text to tell users not to do this. (As the LtiParameters have been deleted, the points can no more be submitted to the consumer.)
@TODO disable/redirect back button?

app/controllers/concerns/lti.rb

@@ -15,19 +15,20 @@ module Lti
   end
   private :build_tool_provider
 
+  # exercise_id.nil? ==> the user has logged out. All session data is to be destroyed
+  # exercise_id.exists? ==> the user has submitted the results of an exercise to the consumer.
+  # Only the lti_parameters are deleted.
   def clear_lti_session_data(exercise_id = nil)
     #Todo replace session with lti_parameter /done
-    #TODO decide if we need to remove all LtiParameters for user/consumer
     if (exercise_id.nil?)
       LtiParameter.destroy_all(consumers_id: session[:consumer_id], external_user_id: session[:external_user_external_id])
-    else #TODO: probably it does not make sense to keep the LtiParameters if the session is deleted
+      session.delete(:consumer_id)
+      session.delete(:external_user_id)
+    else
       LtiParameter.destroy_all(consumers_id: session[:consumer_id],
                                external_user_id: session[:external_user_external_id],
                                exercises_id: exercise_id)
     end
-    session.delete(:consumer_id)
-    session.delete(:external_user_id)
-    #session.delete(:lti_parameters)
   end
   private :clear_lti_session_data