For now, allow owned_by to be set to the user who claims to be an owner without admin authentication