Your server should alway enforce security. Somebody could go around the client if needed. You only build validation and security into the client to help make it faster or more usable. So I would say having both is probably good.