users: add note about invitationToken

this is a one time token that is valid until the account is set up.
this is the reason it has no expiry time.

src/users.js

@@ -194,9 +194,7 @@ function removePrivateFields(user) {
         'id', 'username', 'email', 'fallbackEmail', 'displayName', 'groupIds', 'active', 'source', 'role', 'createdAt',
         'twoFactorAuthenticationEnabled', 'notificationConfig', 'hasAvatar', 'hasBackgroundImage' ]);
 
-    // invite status indicator
-    result.inviteAccepted = !user.inviteToken;
-
+    result.inviteAccepted = !user.inviteToken; // invite status indicator
     return result;
 }
 
@@ -284,7 +282,7 @@ async function add(email, data, auditSource) {
         password: Buffer.from(derivedKey, 'binary').toString('hex'),
         salt: salt.toString('hex'),
         resetToken: '',
-        inviteToken: hat(256),  // new users start out with invite tokens
+        inviteToken: hat(256),  // new users start out a one-time invite token
         displayName,
         source,
         role,