now enforcing attendee limits client-side