Currently the only way to replace the whole document in `update` query is to specify it at the top level:

db.collection.update({_id: ...}, {new: 'document'})

But this makes it problematic because we have to sanitize the new document if it is coming from untrusted source to remove any update operators. It would be really great if MongoDB would provide something a `$replace` update operator, which would work exactly like the query above, but would not allow any update operators:

db.collection.update({_id: ...}, {$replace: {new: 'document'}})