Harden the page contract and ensure that:
- for chat rooms in the chat package, only the chat class enforcing permissions is used
- for other chat ids, either the id is an object the user can read, or the user can at least read on the current connection package