invitedList now sits outside campaign data obj

... for security. It is still part of the mongo document for that
campaign.