added basic permission to check the post's owner
only allow changingcertain fields of posts