The server should maintain all the positions to "make sure" anyway -- this is how you prevent trivial cheating.
Most browsers have a "debug mode" they can be put into. It's trivial for me to hit F12 on my copy of IE, for example, and have access to a JS debugger I can use to halt execution, inspect variables, and change them. So you should be aware that a client could potentially do that.
Even without that sort of effort on the end-user's part, you shouldn't rely on your simulation being in exactly the same state at exactly the same time on all machines; that level of synchronization is basically improbable to achieve for real-time games, since you are dealing with the internet and all the latency involved, floating point inaccuracies, clock drifts, et cetera.
Most of the time things will be "good enough" that you can do what you are asking and send only the updates to the client, allow the clients to simulate locally (this is good, in fact, because it allows you to hide some of the latency and make your game feel better) but you should still simulate everything on the server and periodically ensure the client and server are in sync.
You should not trust client state, ever (not just for browser-based games either).