authenticate for messages#new and #create