Only define Collection.prototype.allow/deny on the server.

Motivated by finding a user created package which added a file
only on the client, in which there were calls to .allow. This way
they would get an error.