Currently in the API, for the track-related methods, we check to see if a user can edit the related event, but we don't check first of all if they are logged in.

This isn't a problem from a security point of view, however it does mean we have to perform some additional DB reads to fetch the event etc, whereas we could quit immediately for anyone who isn't logged in - this is what happens for other methods, such as deleteTalk etc,