Make deny, allow example clear as to client/server

As per [explanation from Avital Oliver in meteor-talk](https://groups.google.com/forum/#!topic/meteor-talk/ZL5P2a6kNE4), I propose making this change in the doc to make it more clear that the code snippet does not need to reside on *both* the client and server.

The title of the sections (deny, allow) from the autoApiBox specify "server". The example got me confused as is.