security bugfix -- cross user comment editing