Lock down some {resource}/new routes further. Modify some regex

Signed-off-by: Max Fierke <max@maxfierke.com>