Make deny, allow example clear as to client/server

As per explanation from Avital Oliver in meteor-talk, I suggest making this change in the doc to make it more clear that the example does not need to reside on *both* the client and server. The title of the sections (deny, allow) from the autoApiBox specify "server". The example got me confused as is.
Merge pull request #3253 from ogourment/patch-1

Make deny, allow example clear as to client/server