Well i got to disagree. If server responds "yes you can write to this object" client can represent form for writing but when he submits this form it depends on

Well i got to disagree. If server responds "yes you can write to this object" client can represent form for writing but when he submits this form it depends on the server again. Client should not trust server as well. If server goes mad it still can be not compromising client-side (unless app was completely hacked and HTML was changed)