favorites resource and controller routes. fighting authenticity token though