fixing authorization requirements for data management api - get and patch should require authorization but only patch requires ownership