Binding on input [type] is broken

**I'm submitting a ...**
```
[x] bug report => search github for a similar issue or PR before submitting
```

**Current behavior**
Try to bind the `type` attribute of input:

```js
// in Class
inputType="number"

// in html

```
Initially, the value is presented as number when doing `form.value`:

```js
{"integerB": 5}
```
Now, try to change the input's value.

**Its type has changed to string:**

```js
{"integerB": "5"}
```

while it seems the html attributes haven't changed:
```html
// chrome dev console

```

**Expected behavior**
If we *are* able to bind to [type], the input type should have stayed "number", so does the value.

**Minimal reproduction of the problem with instructions**
http://plnkr.co/edit/kp0xoDbZmJnD5orOTZUj?p=preview

**What is the motivation / use case for changing the behavior?**
I'm dynamiclly generating forms from given JSON, so binding to [type] can save a lot of copy-paste code.

**Please tell us about your environment:**
Not sure this is relevant as it is reproducible in plnkr.

Thanks.

**Edit**: same goes if binding [type] to `inputType="checkbox"`.
**Edit2**: this is also broken in the Dynamic Forms demo if you change "email" type to number (for example)

Start with the linked Plunker reproduction and the Angular Dynamic Forms demo, then trace how the form value changes after editing an input whose type is bound through [type]. Done means dynamically bound number and checkbox inputs preserve the behavior and value types described in the expected behavior.

Written by the indexing model from the issue text.