require storing the data locally in the session's state instead of sending it out to the client
in a hidden form field.
For any security checks that are performed on the client side, ensure that these checks
are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass