There is no difference compared to a web page - the permissions are still handled server-side, I'm just relaying the events via DDP.