Made $formats protected

One can now extend the class and overwrite all built-in formats, with a app-specific smaller/restricted set of possible mime types.

This is works for my use case, when I only want to accept json and xml, but priorities should be handled by the FormatNegotiator.