when creating a DbObject subclass, allow the typeName to be a function (not just a string) - since the EJSON code expects a typeName function - this makes complete sense
large change to upsertFromUntrusted to make consistent security filtering:

1. the insert a new object path allowed clients to supply secured field values.
2. calling as an instance method resulted in confusion if the 'this' object came from the client or was safely from the server database.
3. check for accidental empty lookups that would have resulted in a global (or single random) document being replaced ( global for real db, single random for mongo)
Merge branch 'master' into patmoore-master