[Help] Where to place Accounts.createUser

From all the tutorials I’ve been exposed to so far, Accounts.createUser was called from the client-side, which is all well and good. But doesn’t it mean that it’s possible for someone to just open up the js-console and run Accounts.createUser? I’m aware of the Accounts.config option to disable client-side creation (and use a Meteor.call() from the client), but then i’m stumped with a new problem, ie Accounts.createUser doesn’t offer any callback in the server-side. How is Accounts.createUser usually called (or rather, where is it usually called from?).

Please refer to the meteor guide, specifically http://guide.meteor.com/accounts.html#adding-fields-on-registration

This should be the canonical place to go to for learning the ropes. Most other tuts (older than 6 months) are likely to be outdated because of the recent churn of technologies.