add roles to users and force ACL by Roles: - only owner or admin can edit listing - only admin can edit event - only admin can edit user - only admin can add user or event