Adds support for read-only masterKey (#4297)

* Adds support for read-only masterKey

* Adds tests to make sure all endpoints are properly protected

* Updates readme

* nits

src/Routers/GlobalConfigRouter.js

@@ -1,5 +1,5 @@
 // global_config.js
-
+import Parse           from 'parse/node';
 import PromiseRouter   from '../PromiseRouter';
 import * as middleware from "../middlewares";
 
@@ -16,6 +16,9 @@ export class GlobalConfigRouter extends PromiseRouter {
   }
 
   updateGlobalConfig(req) {
+    if (req.auth.isReadOnly) {
+      throw new Parse.Error(Parse.Error.OPERATION_FORBIDDEN, 'read-only masterKey isn\'t allowed to update the config.');
+    }
     const params = req.body.params;
     // Transform in dot notation to make sure it works
     const update = Object.keys(params).reduce((acc, key) => {