some more controller validation; User should not create event unless a member of organization or owner