[BUGFIX] Prevent invocation of protected controller methods
Currently any method with an "Action" suffix is callable via the
default request handling if a corresponding route exists.
For the fallback routes provided by Flow this is the case for the
``initialize*Action()`` methods that are called before the actual
This change adds a check for the visibility of an action method
and only allows invocation of public methods.
Releases: master, 2.2, 2.1