> But you can't hand-wave the security concerns of that away... What security concerns, exactly? > There is a fundamental difference between your server retur

> But you can't hand-wave the security concerns of that away... What security concerns, exactly? > There is a fundamental difference between your server returning data versus returning code. If my server returns a bit of something, and then my application code running in the browser takes conditional action based on that return value, was it data or was it code?