Hm, it seems that there's no sanity check for the data in the form. This allows one to edit another person's comments, or even any other existing objects, including rights.

A safer (but longer) approach would be to copy and adapt the code from `readObjectsFromForm` so that it only processes comment objects, and only if the author is the same as the current user.