add basic permission to check post's owner