Security brakeman

Hey guys: need a true PR here.

Gemnasium propose a free security analysis from Brakeman, so I fix here all the "HIGH" risks.
In the process, I dropped GroupingController which was used only by TagController (very old concept we didn't maintain) and rewrite a bunch of rspec.

Please let an eye here: any comment is welcome.
To tell the truth, I consider this bunch of URI.parse(…).path` is a little bit too much. Did it only to satisfy Brakeman analysis (this is "potential" risk, but classified as HIGH, so pretty annoying). Since we make correctly our sanitization of permalink_url, it shouldn't harm.
An other question: is there any use case where permalink could be outside the current request host? I don't see any.