Fix GeoJSON controller for underscore prefix on protected variables

Protected variables in API controllers are now all prefixed with _
Update the record limit and max defaults in GeoJSON api.
Update media API controller to work with ACL

Add media oauth scope and add it to test data.
Add _resource() override for Media and use resource() calls in other
methods.
Also fix minor PHP 5.3 issue in Media Controller.