to clarify on this incident, it was at my server and afaik he was just flexing his internet muscle saying he has it. i don't think he ever actually used it.
i think it should be theoretically impossible to implement invincibility on the client-side since everything related to damage, (the actual state of) projectiles, and players is handled server-side. but maybe i'm wrong and there's some goofy stuff you can do, which would be dumb as hekk