Summary: message reply does not set To; in a limited-authority environment, normal users need to be given the authority to delete messages.

Logged in admin, I sent a message to a normal clinician user. I logged out and then back in as that user. The message flag was set, and clicking it correctly bought up the message screen.

I then clicked Reply.  The message edit screen came up, but the To field was empty.  For a Reply (but not a Forward) I would expect the To field to be pre-filled with the sender's name.

Having sent off the reply, I then clicked Delete - and got the error box saying "Delete Failed - Access is denied". Investigation showed that:

a) since in the standard roles.xml file supplied in the <OPV_HOME>import/data folder, there is nothing about messages, so when I gave the clinician role Create.All and Save.ALL - but no deletion of anything, I thought this was a suitable setup.  In fact they also need message deletion.

b) creating an Authority to remove act.userMessage and giving this to the clinician role fixed the problem.  Messages can now be deleted.

Suggestion: add the following to the roles.xml file

 <data id="REMESS" archetype="security.archetypeAuthority" name="Message Remove" description="Authority to Remove Messages"
  serviceName="archetypeService" method="remove" archetypeShortName="act.userMessage"/>