comments can be submitted via ajax
removed protect_from_forgery from application controler