Security brakeman

Hey guys: need a true PR here.

Gemnasium propose a free security analysis from Brakeman, so I fix here all the "HIGH" risks.
In the process, I dropped GroupingController which was used only by TagController (very old concept we didn't maintain) and rewrite a bunch of rspec.

Please let an eye here: any comment is welcome.
* `.dup`is totally missing. Thanks.
* Array.dup.delete have 2 advantages:
  # Narrow the scope of authorized domain
  # get `nil` if param is not in the domain
  # bonus: both are done in 1 readable line