User invitation feature - allow :token in strong params