Test to ensure we don't allow access to items a user doesn't own  Fixes #67