Small changes to not pass null to JsonBuilder.call
Added transition.@read-only attribute to skip XSRF check for insecure parameters when the transition does not modify data, and when data is not too sensitive
Added some notes for recent changes