added TODO
initial stuff for comment creation/reply privilege checking, and TODOs in the web layer (for a security issue and for static content)