     app.get '/api/submit/:id', ensureLoggedIn, wrap (req, res) ->
         if not req.user?.admin and ""+req.user?.informaticsId != ""+req.params.user
             res.status(403).send('No permissions')
+            return
         submit = (await Submit.findById(req.params.id)).toObject()
         submit = expandSubmit(submit)
         res.json(submit)

    app.get '/api/lastComments', ensureLoggedIn, wrap (req, res) ->
        if not req.user?.informaticsId
            res.status(403).send('No permissions')
        res.json(await SubmitComment.findLastNotViewedByUser(req.user?.informaticsId))

    app.get '/api/lastCommentsByProblem/:problem', ensureLoggedIn, wrap (req, res) ->
        if not req.user?.admin
            res.status(403).send('No permissions')
        res.json(await SubmitComment.findLastByProblem(req.params.problem))

    app.post '/api/setOutcome/:submitId', ensureLoggedIn, wrap (req, res) ->
        if not req.user?.admin
            res.status(403).send('No permissions')
        setOutcome(req, res)

    app.post '/api/setCommentViewed/:commentId', ensureLoggedIn, wrap (req, res) ->

        console.log "Set comment viewed ", req.params.commentId, ""+req.user?.informaticsId, "" + comment?.userId
        if ""+req.user?.informaticsId != "" + comment?.userId
            res.status(403).send('No permissions')
            return
        comment.viewed = true
        await comment.save()
        res.send('OK')
