AJAX messages
Correct abilities for messages controller