Change security to owner instead of just edit

Should probably pass level as a parameter to this function and rename it grant_access(...)