First pass at API implementation.

Some outstanding questions remain due to the fact that comments can be attached to multiple record types. That means, among other things, that the

{
id:
url:
}

pattern is ambiguous...it needs either just url or also record_type:

Similar weirdness in the url links to get the comments for a record like ?record=RecordType,id  (e.g. ?record=Item,2)
Add user data where available.
Adds some missing columns to API, with a check on email.

Might want to check with others about exposing email address to admins in the API. Not sure if we have/need a set of principles about that.
Move comment parent id to a hypermedia thingy. Allow keys with permissions to se unapproved comments