implement getMessageById on server
don't divulge message existance to non-owner
parse out encrypted messages on the client when starting a new session