Allow overriding whether the user can comment from URL.

Not really secure (user can still post comments via API and by changing the
URL and re-requesting the embedded comment form), but at least normal users
are blocked from commenting this way.

pillar/web/nodes/custom/comments.py

@@ -170,6 +170,8 @@ def comments_for_node(node_id):
     node = Node.find(node_id, api=api)
     project = Project({'_id': node.project})
     can_post_comments = project.node_type_has_method('comment', 'POST', api=api)
+    can_comment_override = request.args.get('can_comment', 'True') == 'True'
+    can_post_comments = can_post_comments and can_comment_override
 
     # Query for all children, i.e. comments on the node.
     comments = Node.all({