title: Create Parse objects fail when Class Level Permission says only owner can create the class
body: <h3>Issue Description</h3>
  
  <p>Let's say I have a Parse "Diary class" with a <strong>text</strong> and <strong>owner</strong> property, where <strong>owner</strong> is a pointer. </p>
  
  <p>Using default Class Level Permissions (Pointer permissions) on the dashboard, I imagine anyone can create new objects and claims that they are owned by another random user, like this:</p>
  
  <pre><code>curl -X POST \
    -H "X-Parse-Application-Id: myAppId" \
    -H "Content-Type: application/json" \
    -d '{"text":"hacked","owner": {"__type": "Pointer","className": "_User","objectId": "ANYTHING_THE_HACKER_WANT"}}' \
    http://server.com/parse/classes/Diary
  </code></pre>
  
  <p>So I try to modify the CLP on the dashboard, hoping that diaries that belongs to a user should only be created by the user. But I couldn't get this to work.</p>
  
  <h3>Steps to reproduce</h3>
  
  <p>1) Configure Class Level Permissions on a class like this:</p>
  
  <p><a href="https://i.stack.imgur.com/1g2RX.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/1g2RX.jpg" alt="![Image of CLP](https://imgur.com/a/rMt5T)"></a></p>
  
  <p>2) Try to create new objects, saying they are owned by the logged in user:</p>
  
  <pre><code>curl -X POST \
    -H "X-Parse-Application-Id: myAppId" \
    -H "Content-Type: application/json" \
    -H "X-Parse-Session-Token: r:4613f36ba383022378780d4c2bcdf1cd" \
    -d '{"text":"...","owner": {"__type": "Pointer","className": "_User","objectId": "CSosrTAkxL"}}' \
    https://server.com/parse/classes/Diary
  </code></pre>
  
  <h3>Expected Results</h3>
  
  <p>Diary objects should be created successfully since the person calling this is the owner. I.e. the session token matches the objectId of the owner?</p>
  
  <h3>Actual Outcome</h3>
  
  <p>It returns error instead:</p>
  
  <pre><code>{"code":119,"error":"Permission denied for action create on class Diary."}
  </code></pre>
  
  <p>Why? Am I expecting a right behaviour?</p>