.3y285fc: Owner can now manage Comment permissions

Required pushing the ability to test permissions by Identity into
AccessControl; this should be an overall positive, since we're going to
want to do more of that as we go along.

Includes unit tests for comment permissions.