Modified the "leaveToolSession" and related code to allow the tool to pass the userid (which it gets from UserDTO in the shared session) rather than pass User (which the tool doesn't have).
General changes to use UserDTO from shared session and standard URL parameters.