fix officer serializer?
authorize :comment_on
add more nuanced permissions to :review_only permission level