remove user from routes & dry out paths / tested authentication

user_event_path(current_user, event) ~> event_path(event)