Progress on invitations

Checkpoint.  Only the Owner can now look at Invitees, which protects
email addresses.  Refactored the actual link text to somewhere that we
can more easily inject HTML.