Evaluate all protected controller methods #1063

We have a variety of protected controller methods. Once we release WP-API to the wild, we're committing to keeping those methods around forever.

Before we do, we should some methods as private so they aren't subclassed, and abstract others out to dedicated functions so they can be used without controllers. check_is_post_type_allowed() is one candidate.

Related #1062