Tighter checks so users can't edit events of other orgs