Add spec to test that an identity can't modify events of someone else