revised limit, endAt, and startAt to enforce read-only policy of Firebase data