"Note: Please do not forward this email. Doing so will give other people access to your Anyvite account."
In looking at the URLs embedded in the email, it was clear that they have some hashes glued in there to allow the user to bypass the login.
I'm not trying to bust on Anyvite; I've considered a similar scheme myself.
But I ended up deciding that it was a bad idea. Other opinions?
If someone forwards an email to a friend, that friend will be able to RSVP and comment on behalf of the forwarding user, but they won't be able to create/edit/cancel the event. All of the admin controls still require the admin to login.
We chose this as a matter of convenience since most people will refuse to RSVP anyway and if we required them to fill out a registration form first, we wouldn't be any better than evite. As noodle mentioned, if someone can RSVP on your behalf for a single event, it probably isn't the end of the world. It's completely depending on the security requirements of your app.
I think it's fine in this case for the added convenience of not having to register/login. It's an invitation system not banking.