tighten up /events endpoint and make it more robust