i just reviewed the source code and it only blocks a simple connection to /ajax/messaging/typ.php, /ajax/mercury/mark_seen.php, and /ajax/mercury/change_read_status.php.

good catch to reduce permissions.