Restrict messaging by permission

Users with permission `global.message` may now send messages to users
from all instances, whereas users with permission `instance.message` may
only send messages to users from authenticated instances.
Restrict instance.message to admins by default