add basic ownership - items are created with owner, api endpoints only work if you are the owner, or are an admin, splices only show up in same cases (todo: change ownership)