Expose step_strip_tag_attributes() as protected, allow nulling active_authority_user
Splits user/assignment permission tests to new class