security enhancements to new /events route