Add CSRF token generation and verification. Have 'Params#require' return only the required sub-hash of params.
Update specs to handle new router and controller parameters.