Additional security tweaks

Here are the things we fixed today. I'm not sure why it's including those first two commits from Jan 19 though, as I believe those were already pulled into master from the analytics-export branch.

Also note that the last commit was a work-in-progress to get you started with doing the same thing for reducing controller action redundancy the same way we did in the assignments controller. It still needs to have the routes updated and needs to be tested.