473 question tags

Ready for review. The part I'm most unsure about is the way `@ability` is created and used in the tests, and its interaction with user and mission. But all tests are passing! 
You could write this in a way as to not exercise the database, perhaps by calling .valid? I try to avoid hitting the DB when I can for speed's sake. Not crucial here, just food for thought.