support read-only attributes

Attributes that shouldn't be sent back up to the server (e.g. createdAt, updatedAt) can use the option readOnly