Confusing response from retrieve_event endpoint if valid secret isn't provided

If a valid secret is provided to the retrieve_event endpoint, all stored values are returned. If no secret is provided, or an invalid secret, you still get a 200 response but private fields (e.g. email) will be null. This sort of silent omission is confusing to me, and basically just defers an error until later (e.g. trying to update the event via manage_event and being told at that point that the secret is invalid).

We should just require a valid secret for this endpoint and return a 4xx error if it's not. If you just want to retrieve the public data to display the event, the event endpoint is the way to go (which does not require the event secret). Some testing would be needed to make sure some piece of the puzzle isn't relying on this quirky behavior.

Start by locating the retrieve_event endpoint and any existing tests for secret handling. Verify the current behavior for valid, missing, and invalid secrets, then add coverage for a 4xx response while confirming the public event endpoint remains unaffected.