The most important thing in this commit is: permission

You should know, in Meteor's collection, there's pre-defined callback,
so you can use it.

for allow and deny,  you can use these callbacks

for example: update(userId, doc, fieldNames, modifier)
userId is the current user, doc is the document you want to manipulate