dev: new comment api need cookie and YII_CSRF_TOKEN