Use proper access control

Otherwise you could react to any comment on the entire account. And then
you might as well just do Comment.find.

app/controllers/cards/comments/reactions_controller.rb

@@ -1,4 +1,6 @@
 class Cards::Comments::ReactionsController < ApplicationController
+  include CardScoped
+
   before_action :set_comment
 
   def index
@@ -24,7 +26,7 @@ class Cards::Comments::ReactionsController < ApplicationController
 
   private
     def set_comment
-      @comment = Current.account.comments.find(params[:comment_id])
+      @comment = @card.comments.find(params[:comment_id])
     end
 
     def reaction_params