Serializer API restrictions.

Closes #2289.

If `data=` is passed then ensure that user cannot access `.serializer.data` without first calling `.is_valid()`