I'm just thinking that we should do the ds owner checking.

When you ask for store[0].owner, it should be the manifest url of the app that exposes the datastore, I know that is a bit paraoid, but when DS will become priviledged anyone will be able to create a DS with the name basket_newsletter_address, and despite that the previous one will be already installed, is better to do this checking and be sure that system reads just from the FTU DS.

(I just realised that I'm talking like an alien)