bug fix: any user could edit a message