don't let unauth see event page