add query private, owner check on each HTTP verb. and more. + testcases