fixed defect for users being able to access movements and events they don't own