Jhbate/invite by key

@kentquirk could you take a look please. I still need to do a call,with a server token, to get the inviter user profile but that means a change to go-common 
Sure, and in that case you don't even need the `key` in the link, the `email` would suffice.

This is becoming a "product" thing. I understood that @ianjorgensen and @jh-bate had checked with @HowardLook about displaying "invited by Mary Smith" in an email (and thus on the login screen) and HIPAA, and it seemed to be "ok". If we now change our mind and decide not to, ok, but let's make the explicit decision.