Add new resources via dropdown

Lots of links to create different types of resources were getting messy, so switched to a dropdown. Also wanted to refactor new and create controller actions to remove hardcoded references to classnames. These methods will now work even if class names change, or if resource types are added or removed.
This is still using the old method. It's returning an instance of any constant a hacker can guess the name of.
It may not be an obvious exploit, but directly connecting user input with code execution is always a smell. You need a layer of vetting or sanitising the input first. A clever enough hacker could definitely use this to their advantage.

Another way people often connect user input to code execution is to take params and insert them, unsanitized, into sql statements to be executed on their database. A classic rookie error.

And rarer, but I've still seen it too many times, is people taking params and #send -ing them to instances without first making sure the param is the name of a method they actually want to call on that instance.