Separate the collection route from the individual resource creation route

@gabesullice wrote this in #2971562: Refactor/clean-up Routes.php:

Because while they share a common path, the collection path is read-only, does not need the serialization_class route default (to deserialize) nor CSRF protection (a route requirement).