check if user is actually allowed to access event