Add access checks for inbox and sent

After session is deactivated it shouldn't be able to access this kind
of private data.