More importantly, how do I keep clients from fucking up my database? How is security being done? Seriously, if I'm not capable of baking limitations into data persistence/logic at the server level then this entire framework is worthless except for building up a portfolio of cute demos that can't be used for any real work.
"Please make sure it's reasonably secure. Meteor security isn't as hard as people think. Admittedly it doesn't yet have the delicious "candy coating" that the database and DOM update stuff has, but we didn't, like, forget to put any in. Here's what Made With does:
* Use Meteor.publish() and Meteor.subscribe() to control what clients can see (remove the 'autopublish' package first). Actually you may not need to do this for a blog.
* Use Meteor.methods() and Meteor.call() to define secure server functions and call them from the client. Then lock down your app by disabling the "training wheel" methods that let any client do any write."
Also from a quick skim of the server code itself it looks like they are using connect, so you it's possible that you could roll something up using a connect middleware package like everyauth. [1]
That would mean hosting your own server though rather than using the simple meteor deploy.