restricting non-admin user access to events#new