proper handling of joins / unjoins

perhaps remove support for modifying participants from regular api, but we still return that data. then we can check if the auth user already is part of the event.

if he isnt, we show a join button. and do a POST/PUT to /api/users/:id/intents/:id/participants
if he is, we show a disjoin(!) button. and do a DELETE to /api/users/:id/intents/:id/participants

perhaps
