restrict private view-controller callbacks

restrict private view-controller callbacks - they aren't allowed to avoid side-effects with normal-scoped CDI beans, because private methods aren't proxied.