Return 403 for auth failure
Fix bug on owner checking
Add test code
Implement user