Add CVE-2014-0130 vulnerable code

* add a vulnerable route and controller to use