update() now only runs with cb or explicit true

in previous, versions of mongoose, updates without an explicit callback
were executed as unsafe. This depreciates that feature. fixes #1644