Closes https://github.com/OpenACalendar/OpenACalendar-Web-Core/issues/269 - SECURITY - any user can add any user to any curated list!