add owner auth check to some critical action(such as update/delete etc)