relaxing ownership guard on comments from api - but authorized session still required