when self creating resources pick more abstract owner

E.g. when a user sel-creates a dns entry, this entry should belong to the zone and not the user itself (in case the user owns the zone).

This should prevent making too much of a mess with self-created resources belonging to random user accounts...