Make private resources methods protected
Make Resources more extensible

* Move access control to a separate function
* Reference static:: instead of self::
* Pass all route information to _operation
* Move access icon code into _operation