adds cancan auth for comments