Make InvitationRequestsController explicitly authenticate

* Rather than adding auth as an afterthought to this protected
  controller, let's make it explicitly authenticated and remove auth
  from select actions.
* This seems like a safer habit as you're more likely to accidentally
  require auth where it's not needed than the opposite
* Also this catches the sublety that we were missing auth on the destroy
  and send_invitation actions. Whoops ;)

[#14]
Update views with rel handles to grab in specs

[#14]
Config mailer default url host for test environment

[#14]
Use #find_by_id to avoid exceptions for missing ids

* Thank the specs for showing me! :D (they're coming in future commit)

[#14]
Stand up specs against invitations

[#14]
Add some helpers to clean up some _long_ link_tos

[#14]