Disallow `actor actions` from non-owner senders

[binury]

Such as _wipe_actor 🤦

[geringverdien]

when implementing this i think packets sent by the host should be excluded, would be useful for potential server plugins etc.