add polymorphic comments to posts & projects, add project policy, tweak security with pundit