'You can set a message as starred/un-starred through
POST /json/messages/flags.'

def test_change_star_private_message_security(self):

    self.login(self.example_email('hamlet'))
    message_ids = [self.send_message(self.example_email('hamlet'), self.example_email('hamlet'), Recipient.PERSONAL, 'test')]
    self.login(self.example_email('cordelia'))
    result = self.change_star(message_ids)
    self.assert_json_error(result, 'Invalid    message(s)')
