Require at least one NCS role to access GET /api/v1/events.

We need to require that authenticated users belong to at least one NCS role, too.

This applies to develop (which will happen transitively when 1.8.0 is merged back to master and master to develop) and 1.7.0.pbs.  I'm handling the PBS release.