Fix for BUG #2857758, don't clean() comments before submitting them to setComment...

Fix for BUG #2857758, don't clean() comments before submitting them to setComment. This is somewhat counter-intuitive, but since we clean the comment in setComment itself, cleaning before hand means we end up with doubly escaped data. We don't really have a good way to prevent this (like a subclassed type or something), so we'll go with this for now. The alternative would have been to not clean() the comments in setComment itself, however that would mean that forgetting to clean() it in the passing function would result in a security exploit (and note we already did not apply this uniformly). I think there is a saying to keep the escaping as close to the db interaction as possible, and this seems to mesh with that idea.