Example app should not use insecure/autopublish

[fusepilot]

Any person visiting the cart can explore its entire history by running Cart.Items.find().fetch() in the console and iterate through the array of items. It's probably best to hide this data from the public.

[nate-strauser]

the package has tightly controlled publications https://github.com/nate-strauser/meteor-cart/blob/master/lib/server/publications.js which only send items attached to the userid or deviceid - the example app does have the insecure and autopublish packages still on though, which is likely what you are seeing

i'll update the example app shortly, but for any real usage, the package does not appear to have an issue here