A lot of these bullet points could be paraphrased (better), but
this is at least a starting point.

[ci skip]

active_for_authentication? is only called if password is right, however
invited users has no password by default in devise_invitable, so it's
not used.

Override unauthenticated_message so a different message is displayed
when an invited user tries to sign in.