add permission checks for viewing messages and their stream associations

issue #175