My idea is that Forge should be able to download mods from the server if the server admins choose to enable this. There should also be a confirmation dialog every time a server wants to push mods to a client, and a client-side config option to turn this off.