JSON is preferred for me and I'm guessing others.
Number 4 is definitely a no-no as google might accidentally request it, especially bad with DELETEs, though I doubt that you're offering them.
Some notes I took from a RESTful APIs session I attended once remind me of this:
- Use last modified headers
- A good URI is guessable
- Offer Atom when it makes sense
- Offer iCal when it makes sense
- Provide a client example for your API
- Use OAuth (easie said than done, I'm sure)