diff --git a/mod/lti/locallib.php b/mod/lti/locallib.php
index 55ed0c554a7..94b46f9a28c 100644
--- a/mod/lti/locallib.php
+++ b/mod/lti/locallib.php
@@ -154,7 +154,10 @@ function lti_view($instance) {
     $requestparams = lti_build_request($instance, $typeconfig, $course);
 
     $launchcontainer = lti_get_launch_container($instance, $typeconfig);
-    $returnurlparams = array('course' => $course->id, 'launch_container' => $launchcontainer, 'instanceid' => $instance->id);
+    $returnurlparams = array('course' => $course->id,
+                             'launch_container' => $launchcontainer,
+                             'instanceid' => $instance->id,
+                             'sesskey' => sesskey());
 
     if ( $orgid ) {
         $requestparams["tool_consumer_instance_guid"] = $orgid;
diff --git a/mod/lti/return.php b/mod/lti/return.php
index e896c7ee14c..aa113673c84 100644
--- a/mod/lti/return.php
+++ b/mod/lti/return.php
@@ -31,7 +31,7 @@ require_once($CFG->dirroot.'/mod/lti/locallib.php');
 $courseid = required_param('course', PARAM_INT);
 $instanceid = required_param('instanceid', PARAM_INT);
 
-$errormsg = optional_param('lti_errormsg', '', PARAM_RAW);
+$errormsg = optional_param('lti_errormsg', '', PARAM_TEXT);
 $unsigned = optional_param('unsigned', '0', PARAM_INT);
 
 $launchcontainer = optional_param('launch_container', LTI_LAUNCH_CONTAINER_WINDOW, PARAM_INT);
@@ -39,6 +39,7 @@ $launchcontainer = optional_param('launch_container', LTI_LAUNCH_CONTAINER_WINDO
 $course = $DB->get_record('course', array('id' => $courseid));
 
 require_login($course);
+require_sesskey();
 
 if (!empty($errormsg)) {
     $url = new moodle_url('/mod/lti/return.php', array('course' => $courseid));
@@ -59,7 +60,7 @@ if (!empty($errormsg)) {
 
     echo get_string('lti_launch_error', 'lti');
 
-    echo htmlspecialchars($errormsg);
+    p($errormsg);
 
     if ($unsigned == 1) {