fix security bug in betroommessages

display access denied page from message of betroom which the current
user doesn't belong to