Allow invitation_token in invitations#update
Allow invitation_token in invitations#update

When a user accepts an invitation, devise_invitable looks up the user
using the token from resource_params so we need to permit it. We don't
want to add it to permitted_user_params in the normal role because it's
not a field which normal users should normally be allowed to update.

In an ideal future world, either we'll think of a nicer way to separate out
`resource_params` and other private controller methods that have slightly
different concerns OR Devise and its plugins will stop mixing concepts of
params and a resource's attributes.

alphagov/signonotron2,alphagov/signonotron2,alphagov/signonotron2,alphagov/signonotron2