Yes, that is not the case for invite tokens (requires plugin: discourse-invite-tokens).
I agree we should require at least an additional click, if possible a full-blown accept invite page like we have for regular invites with the ability to choose username and optionally provide name and password.
Agreed.
Added above tasks on my list. 