rewrite: / should not enforce db name
Always copy metadata from 'latest' version to root
Refactor _updates/package to prevent excessive HTTP dancing

Avoid the need to do an extensive back-and-forth dance, since we
actually DO have enough information to know if a PUT is valid, and
can just fake the _rev if it's ok, rather than returning a 409
Handle 'missing data' edge cases

So that super-old npm clients PUTing to an unpublished doc
trigger a 403 instead of a 500.