Build Your First Meteor App And Discover Your Inner Artist

As an extension though, I was wondering if this tutorial could incorporate a discussion on how to secure a Meteor app. It seems to me that in the "Client" code section, we get a reference to a Mongo collection without any explicit permission required from the server. Is the security model that we can get access to any collection created with the "new Meteor.collection" command on the server side? How would we go about validating new inputs and removals from clients modifying the points collection? I think examples and a discussion of these questions would really help this tutorial and help to assage any concerns that people like me get from exposing a raw DB collection to the client.

I also was wondering if Meteor had any easy built-in provisions for offline/unreliable connection modes when you wouldn't be able to rely on a "points.insert({})" call on the client side until connectivity returned?

(apologies if these are super basic Meteor questions - I haven't done anything with the framework, so I don't have much experience with it, but I really liked the straight-forwardness of this tutorial, and these were my natural next questions after reading the tutorial).