Add permissions to the create comment endpoint.

[GraceAtwood]

This actually isn't feasible. I'm going to close it, but if an issue arises, we can reopen it.