clarifying invite user security issue in doc