well, only admin's and owners of the video can see the tag button... but you're right I should make sure that the controller checks for that authorization as well.