separating backend and frontend security