This is what I was thinking about: https://developers.google.com/web-toolkit/articles/security_for_gwt_applications#json