lots of work on OwnedObject -- auth for update, find, etc