Fix too loose strong parameters in the admin interface

There are some attributes that we don't use and/or that should
not be changeable, even by admins.

app/controllers/admin/events_controller.rb

@@ -178,7 +178,7 @@ module Admin
     end
 
     def comment_params
-      params.require(:comment).permit(:commentable, :body, :user_id)
+      params.require(:comment).permit(:body)
     end
 
     def update_state(transition, notice, mail = false, subject = false, send_mail = false)