4.0 work

Fixes some validation problems, enforces permissions when adding tags and fixes some other bugs.  Also adds a test.
Is there server-side validation to ensure that a user isn't able to tamper this hidden param to remove/add a feed they don't have access to?