http://security.debian.org/debian-security/dists/ and http://security.debian.org/dists/ seem to have the same content right now; but debian-security seems to be the "new" standard - use it. (This probably makes hosting mirrors easier)