edit_message now checks session username and pass_hash