moved token generation logic from invitation model into concern