when creating a DbObject subclass, allow the typeName to be a function (not just a string) - since the EJSON code expects a typeName function - this makes complete sense
large change to upsertFromUntrusted to make consistent security filtering:

1. the insert a new object path allowed clients to supply secured field values.
2. calling as an instance method resulted in confusion if the 'this' object came from the client or was safely from the server database.
3. check for accidental empty lookups that would have resulted in a global (or single random) document being replaced ( global for real db, single random for mongo)
Major change with permission handling.

1. permissionCheck: must now be 'public' or a function(userId)
2. cursor and method definitions have now changed ( look in tests/manager-test.js )
3. security can be attached globally, or server-side
4. defining methods and cursors are now very similar to enable easy checking of permissions and consistent handling of alternate ways of supplying the definition. ( i.e. could be { 'name' : { method: function() }, 'name_1': function() }

Net result is code reduction and less hack code.

Now there is no Roles reference in the mcm