Event signin endpoint for nonaffiliates

[godwinpang]

endpoint: /event/:id/signin
endpoint should be optionally protected depending on isAffiliate bool
params: isAffiliate: bool

sample call: curl -X POST /event/:id/signin?isAffiliate=true
if isAffiliate is true, check their token.
else, check their email and return error if they already have an account (can just check against appuser table)

edit: sorta blocked until we do backend auth but can write code w/o auth for now