new policy: don't show messages to clients without a logged in user