enforce security rule client-side