dup the incoming hashed params in the when generating router urls

Since we are deleting keys from the hashed params, we need to dup
the incoming hash to ensure we aren't altering incoming user data.

@jcredding should have caught this in the last PR, ready for review.