client-side restrictions when not owner
Fix typo