send message internally too. and some security checking