cascade delete on tagging
authz work in prog; rspec barely off the ground :)