aim messages endpoint at #testing
make sure message sender has token