blind & cached authentication for MESSAGE
no need for 2 separate acls