As per explanation from Avital Oliver in meteor-talk, I suggest making this change in the doc to make it more clear that the example does not need to reside on *both* the client and server. The title of the sections (deny, allow) from the autoApiBox specify "server". The example got me confused as is.