Trivial change to require user role for /message URLs