Don't allow user to submit fake owner_id in upload