Invite requests should be signed

Currently the invite system doesn't requires any kind of authentication other than being logged in unlike other operations like tracking. On one side this may be confusing to users and on the other it will give an incentive for attackers to attack accounts.

The issue names no files, tests, or entry points. Start by locating the invite system and comparing its request authentication with tracking operations; clarify the signing design and attack scenarios before implementation. Done means invite requests are signed and no longer rely only on being logged in.

Written by the indexing model from the issue text.