Invitations API backend

* Moved invitation creation method to its own controller, decoupling it from the `organization_reports` controller so that the `user_reports` controller can call to it as well
* Tested that only admins can use the Invitations API method with a request spec
* Generalized Michael's `controller_helper` file to be an `authentication_helper` file, and added a similar module for request specs
* updated existing tests and routes to match changes