wrap a readable/writable stream to be read-only