application user to affect state directly in any way other than through legitimate actions
leading to state transitions.
If information must be stored on the client, do not do so without encryption and integrity
checking, or otherwise having a mechanism on the server side to catch tampering. Use