I believe you're correct, but I also thought that calling `allow/deny` on the client has some benefits, even though the docs list it as a server-only function and I don't think it actually runs the functions on the client. I can't remember what it does on the client, if anything. Of course this is just in the test file, so it doesn't really matter.