moved to security model suggested by meteor docs