Checking the operator in $set.op to avoid code injection.

This pull request adds a check for the operator in `$set.op` to avoid code injection.