authentication security over all CRUD except comments model