flagging via ajax
fixed pundit to allow flagging but lock edits