Do not mutuate ACL object passed into constructor

The previous version would promisify the methods of the ACL object passed into the Shield constructor. This was not transparent, and caused some confusion if expecting those methods to behave in the standard callback nature elsewhere in an application.

This has been fixed by assigning the promisified methods to an empty object, rather than overwriting the old methods with them.

Fix bug overriding default options in config

When merging config.defaults with an action-specific config (e.g. config.create), the merge was done in the wrong order, thus causing the defaults to override the action-specific values. Added tests and fixed bug.

Update `main` path and thisArg

This package could not be required because the main path in package.json was set to index.js (which does not exist). Change the main path to be lib/main.js.

Further, when used with io.js v2.4, the reference to this is lost inside of lodash iterator functions. Explicitly specify that this is to be used as thisArg.