Security: exclude Object's class methods

This fix is a follow up of the latest security issues discovered with `ParametersInterceptor` to allow access object's `getClass` method via http request. This also solves problem accessing the same properties via `method:` prefix - it is blocked on OGNL level.