First suggestion is invite tracking only? Yeah, sure. Username w/o token shouldn’t grant TL1 because usernames are public info.
May I suggest that these links take the form of https://meta.discourse.org/signup?u=codinghorror&token=3ojk6WTY to mirror the first part 
didn’t think of that. Going to be tricky to document, but that’s how the settings should interact.