make sure requested formats are supported
expect non-http protocols
pass on secure option for play creation