This avoid calling methods on a new instance of the controller, and therefore allows these methods to be marked as private. As a bonus, rubocop can now parse them and warn when they refer to actions that don't exist in the controller.
The expand_bbox method now needs require_write_api capability on tokens.
