Auth bug fixed, logged in needs to be checked before ownership