security leak fix

leak allowed other users to gain owner access by using wearer's uuid