Invite tokens accepted and ROT13 transformed

[sam (Sam Saffron)]

Hmm @techAPJ a GET request should never redeem an invite, we should require one more click here, is that not the case?

Then the easy fix is just say not valid if the email address has no @ in it, plus it would not be redeemed anyway