This avoid calling methods on a new instance of the controller, and
therefore allows these methods to be marked as private.
As a bonus, rubocop can now parse them and warn when they refer to
actions that don't exist in the controller.
Now that we have all api controllers inheriting from a common base,
it's easier to override the deny_access handler without having to
switch between both.
Fixes#2064
