Make transforms on collections always nonreactive
collection.update() and .remove() may only use IDs as selectors when sending RPCs.

ie, they can use arbitrary selectors on the server and in client stubs, but not
in other client contexts. This is to prevent clients from executing arbitrary
selectors against the DB.

Because of this, the update and remove allow/deny callbacks can only ever get
one doc, so switch them from getting an array to just getting the doc (like
insert).
Update docs: update/remove RPCs may only use IDs as selectors, other tweaks
Remove outdated comment about update/remove rewriting.
Merge branch 'devel' into release-0.5.8
minor docs editing/examples improvement
Merge branch 'devel' into release-0.5.8
Be more explicit in app cache QA file.
Remove XXX comment
Contributing.md regarding the security email address
Merge branch 'release-0.5.8'
Merge branch 'master' into devel
Fixed link to isClient/isServer.
Added link to smart packages.
Added authentication header to break up the rather long data & security section.
Changed JavaScript spelling to be more consistent.
Made links to external projects in package section more consistent.
Merge branch 'pr-784' into devel
Fix allow rule to allow users to update their profile (broken in 0.5.8 release).

Fixes #809.
Use correct new Deps API in Meteor.loggingIn(). Fixes #811.