How to implement physics and AoE spells in an MMO game?

I'm making a game which will be completely centered around PVP battlegrounds and arenas. Think something like WoW, but with the RPG part removed. There will just be a lobby, where you can join a battleground and fight. I plan to use WebGL with the Three.js abstraction.

So, making a game where people can just hit each other isn't my problem - I'd like to have physics play a big role. I simply don't understand how is that possible with open source clients (open source, because it's a website)!

Also, by physics I mean things like burning logs rolling over from a hill, spells that send everything flying around, possibility of dying when hit by a high-velocity object, and so on.

I seem to have only two options:

A, do the calculations on the server

B, do the calculations on the client side

With A, the problem is that I plan to use some plugins for collision detection, and I need to have all the meshes and bounding boxes to test, which I only have access to on the client side! Also, physics might be just a bit too much for my servers to handle.

The obvious problem with B is that you can never trust the client. If I depend on the client telling me that the player got hit really hard and that he did, in fact, throw the player somewhere, that's an obvious security hole. The user can make a simple script that blocks any messages with a "he got hit" header or something, and become invincible.

But, while I was writing this, I came up with a third option, which is to let the client care about others, not just about itself. This falls under the reality checking category, I believe, because if the majority says that someone got hit, and he says he didn't, I'd trust the majority... This option's flaw is that it might be a really big strain on the clients, because this will be a browser game, and my resources are limited.

Answer

When you do AOE, you can use player-sized cylinders for AOE detection. I think Quake does it this way.

Now for the physics question.
There are several solutions I can think of:
1) Do it all server-side, use simplified meshes and bounding boxes, optimize everything.
2) Split into ranked and unranked battlegrounds (instances), and give players the ability to host their own server. Of course, ranked matches would have to be server-side.
3) Somehow authenticate the client (hard to do in JS)