added authorize_owner to membership controller