Extract submission comment logic to #new_comment

Fix bug that allows a forged post request to create a comment,
while the submission is not open for commenting.