I am noticing that the core doesn't really check canComment() permissions before rendering a form or when saving a comment. Seems that we rely entirely on canWriteToContainer() permissions. We need to align these. Perhaps it would make sense to rewrite canComment() to default to canWriteToContainer()