Fix resource permissions

[jgraycar]

Right now, the backend is only checking for a logged-in user before allowing resource viewing, updating, and deleting. This probably shouldn't be allowed unless the resource belongs to the current user... 😝