check for owned org ids instead of just userid
use lastuser loadmodels and permissions
have <profile> in all urls other than file url
have <profile> in all urls other than file url
fix tests and make them pass