Allow unauthorised connections to /api/events, but don't send data till authorised