finishing touches, user profile
authorization in comments to admin, user can create