This avoid calling methods on a new instance of the controller, and
therefore allows these methods to be marked as private.
As a bonus, rubocop can now parse them and warn when they refer to
actions that don't exist in the controller.
This introduces different deny_access handlers for web and api requests, since we want to avoid sending redirects as API responses. See #2064 for discussion.
