Send authenticity hash with messages cookie

At the moment, there's a slight vulnerability in that users can edit their cookies and output arbitrary HTML onto the page. This isn't necessarily a vulnerability by itself, but gives the ability for escalation of existing issues.

To be sure, we shouldn't allow this, and just send a hash along with it. I've used the "nonce" secret here, but there's no real difference in which one we use.