Users controller invite security fix