Added permission check for user messages page