Allow only admins to hit the event rest API