Refactoring: Move rest.updatePrincipal to db package

Updating users is going to involve some extra work (allocating a
sequence) so I'm moving it downwards into the innards of db.
For #314
Users/roles now have sequence numbers that update when they change.

This avoids problems with the _changes feed after a user is given access
to a channel.
Fixes #314