Make it impossible to remove last package owner with json api

Fixing #1089. Removing the last owner creates an ownerless package (we have a bunch of those right now though).