cut most public access so we can serve real event QR codes without leaking personal info