Security issue: reading tracker credentials by subscribing to tracker events

[vinz243]

It's currently possible to listen to tracker events, such as model::willupdate::tracker::* and then fetch trackers credentials. This needs to get fixed before 1.0 by:

• Adding a flag to state, disableEvents: true that will prevent events.
• Add a writeOut props to state which contains a list of props that should get written out before displaying.