Let only the creator invite new members to private groups

A little bug I noticed when reviewing the implementation of the invitation protocol.

See merge request !383