allow access_token header and add reciprocate route for messages