Must be authenticated LTI POST