Moved PI timer logic to its own service. The implementation for room
owner changes has been removed for now.

* Remove redundant `isAuthenticated()` checks
* Move in-method checks to annotations where possible

Moved logic operating on multiple repositories to service layer.

* Prefer ids over "foreign" domain objects.
* Consistently use final keyword for implementation parameters and
  variables.
* As a consequence, session id is used instead of the object as cache
  key for `skillquestions`, `lecturequestions`, `preparationquestions`
  and`flashcardquestions` caches.
* Rename occurances of `questionId` to `contentId`.

Added new service for comments.