restrict edit access only to owner