Comments module - permissions logic seems provided, testing needed