allow every authenticated user to call this endpoint
add permission check: either is admin or is author of comment to remove
introduce ForbiddenException as this is the RESTful response (as we're authorized but just lack the permission, UnauthorizedException doesn't make sense)