BaseController now extracts the authorization token from the request
EventCommand validation moved to EventApiService