child resource methods accept block

resource params are yielded to the block. this enables returning only resources
that the requesting user is allowed to see etc