They can and already place limits on the server side.