This shows a weakness in current code: all routes are loading the account to validate the item owner matches the api requester.  A refactor is in order: oauth validation should load in the request the needed info for these types of checks.