Fix DoS vulnerability in restrict_access

Symbols are not garbage collected, so if .to_sym is called on (a subset of) params, visitors/users can create unlimited symbols, effectively doing a DoS attack against the server.

This commit fixes the DoS vulnerability by making the restrict_access method check against strings instead of symbols.