comments: use comments_pagespec for authorization, not just UI