do not verify the owner on API requests