Hardening for team invitation links; upgrade recommended.
- Invitation accept/cancel links are signed; opening a link shows a confirmation page and the change is a POST
- Accept is limited to the invited user; cancel to the invited user, the team owner or a team admin
- Upgrade note: old unsigned invitation links stop working, resend the invitation to get a new link