correct user permissions - event owners can see their own attendance lists