Make mappings read-only by default

[adambyrtek]

The ones that allow deserialization should be explicitly labeled (e.g. keyword argument).