Verify invite link secrets in constant-time

Existing invite links continue to work. However support for legacy links
(without id) is deprecated and will be removed in the future.