Owner always gets set at creation. because this function is shared with the update path as well, this code will only execute once, and on updates it will not be possible to change the owner.=
 (because it already exists) Someone could put a new owner on their request body, but it will never be changed by this function.