Starts to lock down invitations.

Adds controller spec to test that we attempt to authorize invitation
management. Adds goofy InvitationAuthorizer that ought to prompt us to
write a real implementation.

Also prohibits the current user from accessing stuff outside of their
organizations.
Minor grammatical change

Invite is a verb! :)
Remove pending spec