protect all REST pages with auth
enable users to RSVP for an event