I think we actually don't disagree there, but we have a different understanding of the term "server-side". Anything related to security must happen on the server since safety measures in scripts running client-side can be defeated.