Tidy up and tighten auth rules.

 * Simplify canEditEpisode
 * canCreateEvent and canEditEvent now call canEditEpisode

TODO: extra tests for canCreateEvent