Owners controller api

@floere please give this a look over. Alloy said that this is the preferred way to expose information about an owner, rather than via sessions. Eventually, we will want to remove the owner info in the sessions endpoint.