Add basic queryset filtering for StoredMessage (not yet good enough)

This is not secure. A user might change their email to that of
someone else, and then see the messages. Need a verified email class.