when not logged in, show comment box but disabled
embed timestamp in password reset token, only work for 24 hours
rails 4.0.5 for CVE-2014-0130