Modified the "leaveToolSession" and related code to allow the tool to pass the userid (which it gets from UserDTO in the shared session) rather than pass User (which the tool doesn't have).
Added method to generate tool access code from a string - for when the mode comes in via a form.