Eliminated login requirement during InvitationCode validation:

A user who receives invitation email likely doesn't have an account yet, so we shouldn't force them to the LOGIN_URL to verify their code.  Instead, the developer now has the freedom to choose where to send the user (for example, to a registration page).  As part of this update, Anonymous users are now prevented from poaching a private InvitationCode that doesn't belong to them.

Added specificity and docstrings to tests.py

Added a test scenario for public invitation codes
Note that, currently, Anonymous user will receive the session cookie they need, but still get redirected to LOGIN_URL when verifying.  I think this is a step in the right direction, but not yet ideal.