If it's in JavaScript it's trivial for me to hack on the client side, and if you insist on mouse movements I can just send along a prerecorded array of mouse mo

If it's in JavaScript it's trivial for me to hack on the client side, and if you insist on mouse movements I can just send along a prerecorded array of mouse moves before my request. Maybe even tweak a few every time, so you don't catch on right away. It's more trouble than it's worth.