diff --git a/appview/state/pull.go b/appview/state/pull.go
index 01898a62..dbf727b3 100644
--- a/appview/state/pull.go
+++ b/appview/state/pull.go
@@ -375,7 +375,6 @@ func (s *State) PullComment(w http.ResponseWriter, r *http.Request) {
 				},
 			},
 		})
-		log.Println(atResp.Uri)
 		if err != nil {
 			log.Println("failed to create pull comment", err)
 			s.pages.Notice(w, "pull-comment", "Failed to create comment.")
diff --git a/appview/state/router.go b/appview/state/router.go
index f9d549d7..6297350d 100644
--- a/appview/state/router.go
+++ b/appview/state/router.go
@@ -93,7 +93,7 @@ func (s *State) UserRouter() http.Handler {
 					r.Route("/round/{round}", func(r chi.Router) {
 						r.Get("/", s.RepoPullPatch)
 						r.Get("/actions", s.PullActions)
-						r.Route("/comment", func(r chi.Router) {
+						r.With(AuthMiddleware(s)).Route("/comment", func(r chi.Router) {
 							r.Get("/", s.PullComment)
 							r.Post("/", s.PullComment)
 						})
@@ -103,17 +103,12 @@ func (s *State) UserRouter() http.Handler {
 						r.Get("/", s.RepoPullPatchRaw)
 					})
 
-					// authorized requests below this point
 					r.Group(func(r chi.Router) {
 						r.Use(AuthMiddleware(s))
 						r.Route("/resubmit", func(r chi.Router) {
 							r.Get("/", s.ResubmitPull)
 							r.Post("/", s.ResubmitPull)
 						})
-						r.Route("/comment", func(r chi.Router) {
-							r.Get("/", s.PullComment)
-							r.Post("/", s.PullComment)
-						})
 						r.Post("/close", s.ClosePull)
 						r.Post("/reopen", s.ReopenPull)
 						// collaborators only