Simplify processing of allow/deny rules. Run denies first as Meteor does. Place collection hooks only in deny rules that must run.