Authentication check for viewing a calendar ical was relying on raven credentials - which of course your calendar programme doesn't have.  Instead we should look in the request for userId attributes - these are filled in by the ApiFilter class for us based on the key passed in
Added a restriction on the query for calendar events so that it only finds events owned by the active user.  This fixes the bug in the ical export which was returning _all_ events.