xform share api endpoint

per updated issue, let's add `owner` as a role option