turn private_messages_list into backend functionality and separate it from the controller