Card #226 conversation security on read conversation
switch user split to 2 service calls with different permissions
simplified test: todo: get verify() working with @UserOnly
note: migration may require extra thought, consider consolidating calls similarly to login