Add admin check. (#1716)

* Add admin check.

* Fix teamId check.

pages/api/websites/[id]/events.ts

@@ -25,13 +25,10 @@ export default async (
   await useCors(req, res);
   await useAuth(req, res);
 
-  const {
-    user: { id: userId },
-  } = req.auth;
   const { id: websiteId, startAt, endAt, unit, tz, url, eventName } = req.query;
 
   if (req.method === 'GET') {
-    if (canViewWebsite(userId, websiteId)) {
+    if (!(await canViewWebsite(req.auth, websiteId))) {
       return unauthorized(res);
     }