Views for sending invites - exposed? 

Hi :)
As for now, it seems that any logged in user is able to access the views for sending invites, since the @method_decorator(login_required) is applied to both views (class SendInvite, SendJSONInvite). Shouldn't it be @method_decorator(staff_member_required) ?