fix secondary owner tokens

this also makes exceptions work for secondary owners now; the naming
convention for secowner/s is a major pita