Restrict edit/update/destroy actions to Things the current User owns
Add datetime index on transfers table

Sorting by datetime is a common operation.
Add lent Things collection route
Note about room for implementation improvement