4.0 work

Fixes some validation problems, enforces permissions when adding tags and fixes some other bugs.  Also adds a test.
Ah we're safe because no one can remove media from a feed (ATM). In either case, this hidden field can be tampered with so the server _should not_ rely on a feed id from the client. Rather, the server should load the ids that the user cannot change and ensure that they remain.