473 question tags

Ready for review. The part I'm most unsure about is the way `@ability` is created and used in the tests, and its interaction with user and mission. But all tests are passing! 
This is the right idea. Why not do the same for User, with mocks?