Users should only list/edit/delete URLs they own