Update PUT /items/:id to restrict to owner