resolve URLs: only return strings, never models
invitation list: make textarea read-only