Accept Invitation

What accepting produces: enough for the accept page to say where the visitor landed.

No session and no token: accepting resolves the membership to active and stops there. The identity it resolves to is password-less on the roster until it is claimed, so the next step is POST /v1/auth/signup on the invited address, not a sign-in.