Revise auth in Rest_TagItems::post_members().
- fire 400 if can't view, 403 if can view but can't edit.
- revise controller_auth golden file.
- add unit tests.
Mark Xss_Security_Test as incomplete.
Fix Test::random_tag() to ensure valid tag names (trimmed with no commas).
Add entity to item_tags REST resource - enable GET, PUT, and POST.
Revise Controller_Rest to accept relationship entities (and add unit tests).
Merge pull request #436 from shadlaws/fixes_20130627_2

Fixes 20130627 2