diff --git a/addons/website/controllers/main.py b/addons/website/controllers/main.py
index 417fca99b27..2f49071adf6 100644
--- a/addons/website/controllers/main.py
+++ b/addons/website/controllers/main.py
@@ -130,7 +130,7 @@ class Website(openerp.addons.web.controllers.main.Home):
             html = request.website.render('website.404', values)
         return html
 
-    @website.route('/website/customize_template_toggle', type='json', auth='admin') # FIXME: auth
+    @website.route('/website/customize_template_toggle', type='json', auth='user')
     def customize_template_set(self, view_id):
         view_obj = request.registry.get("ir.ui.view")
         view = view_obj.browse(request.cr, request.uid, int(view_id),
@@ -144,7 +144,7 @@ class Website(openerp.addons.web.controllers.main.Home):
         }, context=request.context)
         return True
 
-    @website.route('/website/customize_template_get', type='json', auth='admin') # FIXME: auth
+    @website.route('/website/customize_template_get', type='json', auth='user')
     def customize_template_get(self, xml_id, optional=True):
         imd = request.registry['ir.model.data']
         view_model, view_theme_id = imd.get_object_reference(
diff --git a/addons/website/static/src/js/website.editor.js b/addons/website/static/src/js/website.editor.js
index 826c2e39091..aa1ab86b330 100644
--- a/addons/website/static/src/js/website.editor.js
+++ b/addons/website/static/src/js/website.editor.js
@@ -517,7 +517,6 @@
 
         fetch_editables: function (root) {
             return $(root).find('[data-oe-model]')
-                // FIXME: propagation should make "meta" blocks non-editable in the first place...
                 .not('link, script')
                 .not('.oe_snippet_editor')
                 .filter(function () {
diff --git a/addons/website_blog/security/ir.model.access.csv b/addons/website_blog/security/ir.model.access.csv
index bfaef7af5f8..13dbed9967c 100644
--- a/addons/website_blog/security/ir.model.access.csv
+++ b/addons/website_blog/security/ir.model.access.csv
@@ -1,5 +1,7 @@
 id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
 blog_category_all,blog.category,model_blog_category,,1,0,0,0
 blog_post_all,blog.post,model_blog_post,,1,0,0,0
-blog_post,blog.post,model_blog_post,base.group_user,1,1,1,1
-blog_post_history,blog.post.history,model_blog_post_history,base.group_user,1,0,1,0
+blog_post,blog.post,model_blog_post,base.group_document_user,1,1,1,1
+blog_post_history,blog.post.history,model_blog_post_history,base.group_document_user,1,0,1,0
+blog_tag,blog.tag,model_blog_tag,,1,0,0,0
+blog_tag_edition,blog.tag,model_blog_tag,base.group_document_user,1,1,1,1