Security brakeman

Hey guys: need a true PR here.

Gemnasium propose a free security analysis from Brakeman, so I fix here all the "HIGH" risks.
In the process, I dropped GroupingController which was used only by TagController (very old concept we didn't maintain) and rewrite a bunch of rspec.

Please let an eye here: any comment is welcome.
Defensive programmation here: it's easy to add a line in the `else` statement that doesn't sanitize the param. You can answer that anybody could use `params[:type]` again in the `else` statement, but I think it'd be easier to spot.