We have a variety of protected controller methods. Once we release WP-API to the wild, we're committing to keeping those methods around forever.

Before we do, we should some methods as private so they aren't subclassed, and abstract others out to dedicated functions so they can be used without controllers. check_is_post_type_allowed() is one candidate.

Related #1062