collection.update() and .remove() may only use IDs as selectors when sending RPCs.

ie, they can use arbitrary selectors on the server and in client stubs, but not
in other client contexts. This is to prevent clients from executing arbitrary
selectors against the DB.

Because of this, the update and remove allow/deny callbacks can only ever get
one doc, so switch them from getting an array to just getting the doc (like
insert).