users can only review events they have attended