remove owner from api endpoint

I guess we do not really need it here, it came up because we expect to check for view permissions when someone does a  `GET` or `HEAD` or `OPTIONS` request.