use common permissions model
move messages models to message-box module