Checking the operator in $set.op to avoid code injection.