Merge pull request #217 from evillemez/master

fixed deserializing read only fields, fixed upload route requiring API key