auth-check + ACL

Finished auth-check method
Updated the ACL to allow the Staffs group to share an event