use load_and_authorize_resource in the admin events/attendees controllers