Bug fix for history, make history API private

* GET /messages only returns a logged in user's messages (before you could access anybody's history)
* fix history categories in GET /messages