has_and_belongs_to_many - ensure only rows with there user_id are returned

[Tom_Mornini1 (Tom Mornini)]

@session['user'].messages.find(params[:id])