owner authorization for models
allow non-mongoose models