Add api-readonly switch

This disables all JSON-API-level changes to backend data.