allow (require?) limiting of available cmd targets

Currently, an OP_CMD can call any method of an endpoint. It would probably be good to restrict this in one or both of the following ways:

1. any function which starts with an underscore (`_`) should be rejected with an error. The same should be true for setting attributes with the same name pattern.

2. it should only be possible to call a restricted subset of "whitelisted" methods. I'm not sure exactly how this would work, but I think the nicest way would be to apply a decorator to functions we want to whitelist. We could also consider the other side and have a decorator which prevents a method from being called directly by an OP_CMD.

Item 1 should be easy to just add to the logic in `Endpoint`. Item 2 will require more thought and some experimenting.