some client-side security