Security improvements

* Don't use `redirect_to` from parameters ([brakeman](http://brakemanscanner.org/docs/warning_types/redirect/index.html), [OWASP](https://www.owasp.org/index.php/Top_10_2010-A10))
* Fix invite authentication for `create` action (!)

p.s. maybe it's time for a -security mailing list