fix bug 1063693 - browser.slug is write-once

Converted `UpdateOnlyMixin` to more general `WriteRestrictedMixin`, added `write_once_fields`