diff --git a/addons/website/controllers/main.py b/addons/website/controllers/main.py
index 30f384a606b..2f49071adf6 100644
--- a/addons/website/controllers/main.py
+++ b/addons/website/controllers/main.py
@@ -51,8 +51,7 @@ class Website(openerp.addons.web.controllers.main.Home):
     def index(self, **kw):
         return self.page("website.homepage")
 
-    # FIXME: auth, if /pagenew known anybody can create new empty page
-    @website.route('/pagenew/<path:path>', type='http', auth="admin")
+    @website.route('/pagenew/<path:path>', type='http', auth="user")
     def pagenew(self, path, noredirect=NOPE):
         module = 'website'
         # completely arbitrary max_length
@@ -131,7 +130,7 @@ class Website(openerp.addons.web.controllers.main.Home):
             html = request.website.render('website.404', values)
         return html
 
-    @website.route('/website/customize_template_toggle', type='json', auth='admin') # FIXME: auth
+    @website.route('/website/customize_template_toggle', type='json', auth='user')
     def customize_template_set(self, view_id):
         view_obj = request.registry.get("ir.ui.view")
         view = view_obj.browse(request.cr, request.uid, int(view_id),
@@ -145,7 +144,7 @@ class Website(openerp.addons.web.controllers.main.Home):
         }, context=request.context)
         return True
 
-    @website.route('/website/customize_template_get', type='json', auth='admin') # FIXME: auth
+    @website.route('/website/customize_template_get', type='json', auth='user')
     def customize_template_get(self, xml_id, optional=True):
         imd = request.registry['ir.model.data']
         view_model, view_theme_id = imd.get_object_reference(
@@ -215,7 +214,6 @@ class Website(openerp.addons.web.controllers.main.Home):
                         'value': new_content,
                     }
                     irt.create(request.cr, request.uid, new_trans)
-        irt._get_source.clear_cache(irt) # FIXME: find why ir.translation does not invalidate
         return True
 
     @website.route('/website/attach', type='http', auth='user')
@@ -329,21 +327,13 @@ class Images(http.Controller):
         if response.status_code == 304:
             return response
 
-        return self.set_image_data(
-            response, record[field].decode('base64'),
-            fit=(int(max_width), int(max_height)))
+        data = record[field].decode('base64')
+        fit = int(max_width), int(max_height)
 
-    def set_image_data(self, response, data, fit=(maxint, maxint)):
-        """ Sets an inferred mime type on the response object, and puts the
-        provided image's data in it, possibly after resizing if requested
-
-        Returns the response object after setting its mime and content, so
-        the result of ``get_final_image`` can be returned directly.
-        """
         buf = cStringIO.StringIO(data)
 
-        # FIXME: unknown format or not an image
         image = Image.open(buf)
+        image.load()
         response.mimetype = Image.MIME[image.format]
 
         w, h = image.size
diff --git a/addons/website/static/src/js/website.editor.js b/addons/website/static/src/js/website.editor.js
index f9d2aef339b..6fb0f459a22 100644
--- a/addons/website/static/src/js/website.editor.js
+++ b/addons/website/static/src/js/website.editor.js
@@ -517,7 +517,6 @@
 
         fetch_editables: function (root) {
             return $(root).find('[data-oe-model]')
-                // FIXME: propagation should make "meta" blocks non-editable in the first place...
                 .not('link, script')
                 .not('.oe_snippet_editor')
                 .filter(function () {
diff --git a/addons/website/static/src/js/website.snippets.js b/addons/website/static/src/js/website.snippets.js
index 0b1ab4e13cd..c29325c8de8 100644
--- a/addons/website/static/src/js/website.snippets.js
+++ b/addons/website/static/src/js/website.snippets.js
@@ -25,8 +25,8 @@
         save: function () {
             this.snippets.make_active(false);
 
-	    // TODO TOFIX: call clean_for_save on all snippets of the page, not only modified ones
-	    // important for banner of parallax that changes data automatically.
+            // FIXME: call clean_for_save on all snippets of the page, not only modified ones
+            // important for banner of parallax that changes data automatically.
             this.snippets.clean_for_save();
             remove_added_snippet_id();
             this._super();
diff --git a/addons/website_blog/security/ir.model.access.csv b/addons/website_blog/security/ir.model.access.csv
index bfaef7af5f8..13dbed9967c 100644
--- a/addons/website_blog/security/ir.model.access.csv
+++ b/addons/website_blog/security/ir.model.access.csv
@@ -1,5 +1,7 @@
 id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
 blog_category_all,blog.category,model_blog_category,,1,0,0,0
 blog_post_all,blog.post,model_blog_post,,1,0,0,0
-blog_post,blog.post,model_blog_post,base.group_user,1,1,1,1
-blog_post_history,blog.post.history,model_blog_post_history,base.group_user,1,0,1,0
+blog_post,blog.post,model_blog_post,base.group_document_user,1,1,1,1
+blog_post_history,blog.post.history,model_blog_post_history,base.group_document_user,1,0,1,0
+blog_tag,blog.tag,model_blog_tag,,1,0,0,0
+blog_tag_edition,blog.tag,model_blog_tag,base.group_document_user,1,1,1,1