fix: correct read only create behaviour

Read only create failed to work correctly due to the way DRF serializers
behave. Updates to work consistently, and adds test to cover this case.