- class ChangesetCommentsController < ApplicationController
- skip_before_action :verify_authenticity_token
+ class ChangesetCommentsController < ApiController
+ before_action :check_api_writable
+ before_action :check_api_readable, :except => [:create]