They're not asking "how does this work?", they're asking "how is this secure?". The answer is, it's not. This is terrible code and should never be written like

They're not asking "how does this work?", they're asking "how is this secure?". The answer is, it's not. This is terrible code and should never be written like this - the check can be bypassed client side, letting the user act as an owner no matter what the response claimed.