fixed deserializing read only fields, fixed upload route requiring API key