They are _not_ read-only. If you want to push, they will use http auth for authentication. (Obviously you need an account for pushing, but that's given.)

Peter