added before_filter :authenticate_user! to comments_controller. user must be logged in to add comment