Default service call doesn't check permissions.

Hi,

I am trying to update comment from default service call. I am passing session in header of logged in user due to this drupal service will consider that user as logged in user and update comment by that user name.

Here is my code,

var obj = {
//"subject":"liJmJfpqMX",
"comment_body":{"und":[{"value":" updated ..this is comment is from rest service.."}]},
"cid":cid
};
$.ajax({
url: "MY_SITE_URL/my_services/comment/"+ 89+".json",
headers: {
"session": "SESS49960de5880e8c687434170f6476605b=m4Lw6KqhPCnnN7ni9IgGA4eaoyWeI7YwWOEbFPoPnpw",
"Cookie": "SESS49960de5880e8c687434170f6476605b=m4Lw6KqhPCnnN7ni9IgGA4eaoyWeI7YwWOEbFPoPnpw",
},
crossDomain: true,
type: 'PUT',
ContentType: "application/json",
"data" : obj,
dataType: 'json',
error: function(XMLHttpRequest, textStatus, errorThrown) {
alert('VIew Comment - failed to show'+ textStatus + errorThrown);
},
success: function (data) {
alert("Success :) ");
}
});
}

In above code I am passing session to one user(A) and given comment is of user is posted by another user(B), once i run this code comment is updated and author is set to user A.

But as per pemissions i set only author can update self comments.

Please suggest me solution!!!

Thanks in advance!!