Fix param handling

Each key could only have one nested has value or it would be overwritten.
Also, I wasn't decoding the urlencoded string.  Why did that work?
Add CSRF checking to ControllerBase