Pb comments

validate `:user` and `:review`, not the ids