beware of method names like "main::unsafe" for example. can() will return \&main::unsafe and not undef. this is also addressed in perlsec.pod.
better will be checking in a dispatch table in case $method comes from outside.