Make transforms on collections always nonreactive
collection.update() and .remove() may only use IDs as selectors when sending RPCs.

ie, they can use arbitrary selectors on the server and in client stubs, but not
in other client contexts. This is to prevent clients from executing arbitrary
selectors against the DB.

Because of this, the update and remove allow/deny callbacks can only ever get
one doc, so switch them from getting an array to just getting the doc (like
insert).
Update docs: update/remove RPCs may only use IDs as selectors, other tweaks
Remove outdated comment about update/remove rewriting.
Merge branch 'devel' into release-0.5.8