According to
this thread, Calendar is also broken. I checked it and it is true: no permissions check. Any user can post to any public Calendar. Actually they are encouraged to do so, as they appear in the drop down list of choices! I'll try to look into this for a quick fix.
