block sign ups unless they come via an invite