restrict comments to signed-in users