Malicious selector can be passed into tabular_getInfo

`tabular_getInfo` can be passed a selector that contains `$where`, which could potentially be used to [hang a mongo instance](http://blog.east5th.co/2015/08/10/dos-your-meteor-application-with-where/).

Not sure what you want to do about this. `$where` has its uses, but this is can be a fairly serious problem.

No source file or test is named. Start at tabular_getInfo and trace how the selector reaches MongoDB, then read the linked $where denial-of-service report. Done should include a decided, verified handling of $where that addresses the risk without silently breaking supported selectors.

Written by the indexing model from the issue text.