adding a checkcalendar role that can just view the calendar, including unpublished events