Bugfix comment permissions

Updates policies to match client side display rules for tasks.

References: https://www.pivotaltracker.com/story/show/79563784

### AC & CT
The comment confuses me. Do you mean to show a kind of repl session?
How about `# paper.editors   # => [user1, user2]`?