add "tiered" access policy, add tagcloud to directory pages