enabled a role-based restriction on message listing using @PreAuthorize annotation