this does not fully work as the server does not update `isOwner` in the client when the user authenticates.