Update safety checks

A couple safety checks for updates:

* Disallow EJSON custom types and anything other than plain objects for replacement updates. This matches a check that we do in `insert`.
* Throw an error if you try to update with a modifier that looks like this: `{ foo: 'bar', $set: { foo: 'bar' } }`. This is illegal according to mongodb anyway, so this is just an extra safety check (and a reassurance that we'll continue enforcing this even if mongodb changes its behavior someday).

@n1mmy, @glasser: could you please take a look?
How about "Update document cannot have both modifier and non-modifier fields" or "Update parameter cannot have both..."? Both "<update> document" and "update parameter" are used in the mongodb docs here: http://docs.mongodb.org/manual/reference/method/db.collection.update/#update-parameter