Clamp the "to" token for /rooms/{roomId}/messages to when the user left

the room.

There isn't a way for the client to learn a valid "to" token for a room
that they have left in the C-S API but that doesn't stop a client making
one up.