by Frode Halvorsen.
Ok - is there any url that can be used for a logged in user to get an api-token ? Because if there is, we can use that instead, since the user doing the lti-launch has a valid UI-session in Moodle, than then can be used to obtain the token.