[Authentication, authorization, and permissions](http://loopback.io/doc/en/lb3/Authentication-authorization-and-permissions.html#hiding-methods-and-rest-endpoints) still refers to `disableRemoteMethod` but in 3.0 this changes to `disableMethodByName` per http://loopback.io/doc/en/lb3/3.0-Release-Notes.html#clean-up-of-api-for-finding-and-disabling-remote-methods Cf https://github.com/strongloop/loopback.io/pull/297#issuecomment-283571060