Enable commenting by accounts that do not belong to an organization.

Add method Account#allowed_to_comment?  and move CORS header setting
to start of method so browser gets a reply even if the action
terminates early.