now the custom permission evaluator is used while retrieving a message by its id