Add _csrf_token check for all non-GET requests
Change controller_name to no longer include controller
Fix route params to be symbols instead of strings