dynamic respond_to in ResourceController

this is a fix for #3539

befor this change, AA respond to html, xml and json on each action, that's a securty problem while the user can view a record as xml and see the raw data.

after this change AA respond only to html on each action and respond to xml, csv, json only it the format is configured for the download links.

Now a user can only see that data he has access to