Reuse an authorized session after a completed invitation exchange
After a one-time invitation exchange has completed, an invitation landing route should prefer an existing authenticated session instead of replaying the invitation token. Apply this only when that session is already authorized for the requested access; authentication alone does n…