Mod invite: Ensure that user is an unlimited mod

This was previously being enforced in the frontend but not the API.