some support for rw membership. ownership auth seems broken