permission filter comments user_id must eq current user included