could you make the controller throw 403 Forbidden if the user changing the status is not a recipient? consider 404 if the message doesn't exist or hasn't yet been received.