Output format plugin

This is early work. I just wanted you to have a peek to the direction this is turning into.
>  Maybe we should have something that determines if HAL applies. I'll try to come up with something.

Maybe we could (as you did initially) have a JSON base class, that is used by default for non-handlers? In that case the CSRF would use that formatter which will not have the token under ``data[0]`` - which is weird ;)