[api] do not try to delete nothing

If a submit request is set to cleanup but is from home:$USER it won't
cleanup - but it shouldn't crash either
[api] refactor messages controller

I would like to get rid of it actually, it's never been used (in SUSE's
instances at least)
[api] refactor more of the source controller