I've taken your followup for creategroup/createlink/etc. and have continued work on this in there, as it needs the creategroup and setpermissions widget. That branch also contains the follow-up work I've been doing with Sam today. I'll make the fix part of that work, even though it technically shouldn't be necessary to escape the tenant name.