Disallow actions to pieces a user doesn't own

Fixes #1, #2, #6.