Check ownership

Adding an ownership check plus adding client_id and user to request.