Only authenticate requests that route to /event/*

Without this patch all routes are authenticated.  This is a problem
because I want the default route to be unauthenticated so the app may be
started in a manner that returns a 200 status.