Perform inbox routing in controller #268

The redirect in the router was bypassing the controller which was:
* Leading to tests passing when functionality was broken
* Blindly redirecting without actually checking permissions.