Modify controller to send 404 when appropriate, return array to convert to JSON.

Register route using correct controller.
Inject URL generator into view; implement url function.
Prevent using expired token.
Get entity property correctly.