Pledge Invite potentially a security violation

[dfangshuo]

Anyone can read from/write to the pledge invite table, which contains PII such as a person's email, phone number , username tec.

Pledge Invite: Potentially move this to pre-creating Owner object
Potential Solution #2
have an endpoint on the node server that takes an a pledge invite ID and lets you know whether it exists, and if it does, it returns the object. so that way, we don’t have to have open read access to the pledge invite table