patch to fix https://github.com/pouchdb/pouchdb-server/issues/97#issuecomment-96176606

securityWrapper.js

function securityWrapper(checkAllowed, original, args) {
  var userCtx = args.options.userCtx || {
    //Admin party!
    name: null,
    roles: ["_admin"]
  };
  if (userCtx.roles.indexOf("_admin") !== -1) {
    return original();
  }
  if (!checkAllowed) {
    return Promise.resolve().then(throw401);
  }

  var promise = filledInSecurity(args)
    .then(function (security) {
      if (!checkAllowed(userCtx, security)) {
        throw401();
      }
    })
    .then(function() {
      var originalPromise = original();

      if (originalPromise.on) {
        queuedOnCalls.forEach(function(args) {
          originalPromise.on.apply(originalPromise, args);
        })
        queuedOnCalls = undefined
        promise.on = originalPromise.on.bind(originalPromise);
      }
      return originalPromise;
    });

  var queuedOnCalls = [];
  promise.on = function() {
    queuedOnCalls.push(arguments);
    return promise;
  }

  return promise;
}