Any idea how the "don't display tags if they can't access any post with that tag" functionality works? Presumably that's creating some sort of tag-specific access list, either statically or dynamically; maybe it'd be possible to create counts at the same time.