[CSRF] No Csrf protection against sending invitation to join the team.