I appreciate the brief diversion at the end (which I would summarize as 'make sure your users can't delete your entire database'), but it seems like there's nothing on which to base fundamentals/best practices for Meteor security yet...