Fix for hole in deleting all comments

Wrote a custom role resolver to check if a user is the owner of a post
before its related comments are deleted.

This is changed from delete being allowed if the post is the owner of
the comments, which is always true when deleting a post, therefore an
api call of delete all comments with a readily available postId could
be called by any logged in user.