text: Title: post view has a little bug
  Body: Hi Miguel,
  
  I am studying flask using your tutorials. Thanks for your helpful book and codes. 
  
  There I find a little bug in the `post` view in the views.py file in the main blueprint. That is this view doesn't check whether the current user has `Permission.COMMENT`. I noticed that you removed the comment form in the template when the current user has no comment permissions. However I think that the `post` view should have its own validation logic. If an anonymous user send a post request to this view,  an error will be raised.
  
  `AttributeError: 'AnonymousUser' object has no attribute '_sa_instance_state'`
  
  Thanks.