Fix DoS vulnerability in restrict_access

Symbols are not garbage collected, so if `.to_sym` is called on (a subset of) `params`, visitors/users can create unlimited symbols, effectively doing a DoS attack against the server.

This commit fixes the DoS vulnerability by making the `restrict_access` method check against strings instead of symbols.