Tighten up rules around route validation

Specifically we want to:

 * reject routes that are a string-prefix of the
base_path, but not an actual folder below the base_path.
 * reject routes where a prefix base_path is included
Globally stub all route registration by default

We can still verify the expected router calls were made (or not made)
where required using assert_requested/assert_not_requested
Tighten up route registration coverage

Instead of mocking internal code, we verify the appropriate rout
registration requests were made using webmock helpers. This brings us
closer to an end-to-end test for creating and updating content items.
Do not implicitly create route for base_path

This was too much magic. Better to require that all routes are
explicitly set when creating/updating content.