Reversed the stupid mistake of referencing the invitation directly when creating a new user - uses the invitation token instead now to make messing around naughtily much harder