Update safety checks

A couple safety checks for updates:

* Disallow EJSON custom types and anything other than plain objects for replacement updates. This matches a check that we do in `insert`.
* Throw an error if you try to update with a modifier that looks like this: `{ foo: 'bar', $set: { foo: 'bar' } }`. This is illegal according to mongodb anyway, so this is just an extra safety check (and a reassurance that we'll continue enforcing this even if mongodb changes its behavior someday).

@n1mmy, @glasser: could you please take a look?
Probably clearer to just say "Only plain objects may be used..."