Fixed the destroy session logic.

1. an exercise_id is provided ==> only the LtiParameter object for the current user, consumer, and exercise is deleted.
2. no exercise_id is provided ==> external user and consumer are removed from the session, all LtiParameter objects for this user and consumer are deleted.

This enables users to have several tabs with exercises open and submitting the results to the tool consumer.
When an exercise has been submitted, the user cannot use the back button to get back to CodeOcean and work on the submitted or any other exercise.
For now a warning has been added to the info text to tell users not to do this. (As the LtiParameters have been deleted, the points can no more be submitted to the consumer.)
@TODO disable/redirect back button?

app/controllers/sessions_controller.rb

@@ -38,7 +38,6 @@ class SessionsController < ApplicationController
   def destroy_through_lti
     @consumer = Consumer.find_by(id: params[:consumer_id])
     @submission = Submission.find(params[:submission_id])
-    #TODO decide if we need to remove all LtiParameters for user/consumer
     clear_lti_session_data(@submission.exercise_id)
   end