Create rootContainer with single owner only

With the revert to a single-owner-per-container model, the root
container for a newly-created profile needs to set "owner" instead of an
"owners" object with a single child.