fix spec
allow password-less invites