Protect user_id and add route resource for comments