Tighten up rules around route validation

Specifically we want to:

 * reject routes that are a string-prefix of the
base_path, but not an actual folder below the base_path.
 * reject routes where a prefix base_path is included
Globally stub all route registration by default

We can still verify the expected router calls were made (or not made)
where required using assert_requested/assert_not_requested