Added allowed invitee roles property

Additionally change the api url to avoid redirect