Centralize all mutations at the model level

This commit uses a new package that I need to document. It tries to
solve the long-standing debate in the Meteor community about
allow/deny rules versus methods (RPC).

This approach gives us both the centralized security rules of
allow/deny and the white-list of allowed mutations similarly to Meteor
methods. The idea to have static mutation descriptions is also
inspired by Facebook's Relay/GraphQL.

This will allow the development of a REST API using the high-level
methods instead of the MongoDB queries to do the mapping between the
HTTP requests and our collections.

client/components/cards/attachments.js

@@ -15,10 +15,10 @@ Template.attachmentsGalery.events({
     // XXX Not implemented!
   },
   'click .js-add-cover'() {
-    Cards.update(this.cardId, { $set: { coverId: this._id } });
+    Cards.findOne(this.cardId).setCover(this._id);
   },
   'click .js-remove-cover'() {
-    Cards.update(this.cardId, { $unset: { coverId: '' } });
+    Cards.findOne(this.cardId).unsetCover();
   },
 });