Clarify that redaction events are still subject to all applicable auth rules.