Binding on input [type] is broken

**I'm submitting a ...**
```
[x] bug report => search github for a similar issue or PR before submitting
```

**Current behavior**
Try to bind the `type` attribute of input:

```js
// in Class
inputType="number"

// in html

```
Initially, the value is presented as number when doing `form.value`:

```js
{"integerB": 5}
```
Now, try to change the input's value.

**Its type has changed to string:**

```js
{"integerB": "5"}
```

while it seems the html attributes haven't changed:
```html
// chrome dev console

```

**Expected behavior**
If we *are* able to bind to [type], the input type should have stayed "number", so does the value.

**Minimal reproduction of the problem with instructions**
http://plnkr.co/edit/kp0xoDbZmJnD5orOTZUj?p=preview

**What is the motivation / use case for changing the behavior?**
I'm dynamiclly generating forms from given JSON, so binding to [type] can save a lot of copy-paste code.

**Please tell us about your environment:**
Not sure this is relevant as it is reproducible in plnkr.

Thanks.

**Edit**: same goes if binding [type] to `inputType="checkbox"`.
**Edit2**: this is also broken in the Dynamic Forms demo if you change "email" type to number (for example)

Beginne mit der verlinkten Plunker-Reproduktion und der Angular Dynamic Forms-Demo und verfolge dann, wie sich der Formularwert ändert, nachdem ein Eingabefeld bearbeitet wurde, dessen Typ über [type] gebunden ist. Als abgeschlossen gilt die Aufgabe, wenn dynamisch gebundene Number- und Checkbox-Eingabefelder das im erwarteten Verhalten beschriebene Verhalten und die dort beschriebenen Werttypen beibehalten.

Vom Indexierungsmodell aus dem Issue-Text verfasst.