* add a `source_reference` field to store message-id
* store the raw content "as is" - there is not preview for this reason (
  because it might be unsafe html or whatever)
* remove proxy roles on scripts. User must have permission.
* minor simplifications