allow users to moderate comments / also addressed some csrf vulnerabilities