(#2484) - fix readOnly replication for CORS/40*

Currently we only mark a source database as
read-only if it returns a 401. Really we should
do it for any 40*, and also in the case of CORS
the error status is a deceptive 0, so this doesn't
help.

Ugly hack, but I verified manually that using a
CouchDB that only accepts CORS methods GET and HEAD,
I can now replicate in Safari 7, IE 11, Chrome 36, and Firefox 30.
(#2428) - fix args for remove()

It turned out there were a lot of argument
combinations that we weren't checking in the
tests, which is probably why this one slipped
through.

In addition, I added a fix to make it so you can
specify the rev in the options, and it'll use that
if the _rev isn't defined in the document. This is
not something I want to advertise in the docs (since
the usage is complicated enough as it is), but I think
it may help folks who are used to the CouchDB style
where we think of the Pouch options as being equivalent
to the Couch HTTP params.
(#2337) - fix replication event listener memory leak
(#2447) - link pouchdb-server's pouchdb to us in travis

Travis seems to be an unusual environment where the
immediate dependents of a module that depend on that module
are not automatically symlinked to it.  So this fix is to
only do it in Travis.

This is required to unblock #2442.
(#2442) - Allows replication fields in docs
(#2477) - use a Map and Set instead of an object when we have user supplied values