updated to use link host_* attrs; added 403 to chat POST if not in the room