Security brakeman

Hey guys: need a true PR here.

Gemnasium propose a free security analysis from Brakeman, so I fix here all the "HIGH" risks.
In the process, I dropped GroupingController which was used only by TagController (very old concept we didn't maintain) and rewrite a bunch of rspec.

Please let an eye here: any comment is welcome.
Two things:
* The comment only makes sense if you know what code was there before, so I think it should be removed.
* You're deleting the parameter from the actual constant. I think `.dup` is missing.
* I'm not familiar with this idiom. Why not use `Only_domain.include? params[:only]`?