can accept and reject inv by user_id (closes #20)