Integrate with url-arbiter

This changes the ownership check to use url-arbiter instead of a local check.

This is feature-flagged (url-arbiter isn't in production yet), and when disabled the original check still applies.
When using `and`, it does the right thing.  I'm not sure when using `&&` - I'd thefore want to add parens to be sure (and to make it clear to a reader).  I think this is one of the cases where following the styleguide would make the code less readable...