Don't allow clients to call update methods as upserts.

Add test for it. This is a way to avoid the complexity of allow/deny rules for
upserts; for now, if you want to do an upsert, do it in a method.
Implement upsert in minimongo.

i.e. delete the code where we throw an exception if you try to upsert.