Security brakeman

Hey guys: need a true PR here.

Gemnasium propose a free security analysis from Brakeman, so I fix here all the "HIGH" risks.
In the process, I dropped GroupingController which was used only by TagController (very old concept we didn't maintain) and rewrite a bunch of rspec.

Please let an eye here: any comment is welcome.
GitHub stopped showing my comment, so I'll repeat it here:

Perhaps this whole `if` block can be made even simpler like this, just ignoring any erroneous values:

```ruby
only_param = Only_domain.dup.delete(params[:only])
scoped_feedback = scoped_feedback.send(only_param) if only_param
```