FEATURE: generate email less invite tokens

We should have a `params.permit` for the optional params like `:username` and `:quantity`