added auth check for message update