use push instead of replace in ensureURL

[vvenv]

Fixes #887

[fnlctrl]

Hmm, using pushState/pushHash is a valid fix for the scenario in #887, though it shouldn't be done in ensureUrl, instead they should only be triggered after next(false) is called, here: https://github.com/vuejs/vue-router/blob/dev/src/history/base.js#L70-L72.
Would you mind fixing it? Should probably add a parameter to ensureURL to decide whether to call replace or push.

/ping @posva @LinusBorg