I kept hoping the next paragraph would address this, but it didn't. It's cool and all, but it sounds like you're still going to basically need a server stack t

I kept hoping the next paragraph would address this, but it didn't. It's cool and all, but it sounds like you're still going to basically need a server stack there to enforce permissions and some logic and consistency things. For example, say users have some private data. What stops me from modifying the javascript to insert a record that points to someone else's email address in my record? Unless the database can see this and prevent it I might then be looking at or even able to change someone else's email on their account. It can get very hairy if you don't have full control over the database interaction because you have to start guarding against arbitrary database operations.