updated authorization so customer canot edit anything except their own comment