middleware: don't check invitation code if empty (avoid 1 DB hit per page)