My proposal is that almost nothing moves to the dbms, everything moves to the client except perhaps authorization. Unfortunately I can't fully defend my line of reasoning without saying, here's a link to my fully described or developed alternative architecture, which I don't have. However that doesn't mean it's not possible, it seems to me to be achievable. Even if it would require changes to HTTP, the database (row, column, and cell-level authorization?), or the browser - the end result would presumably be worth it. I imagine it would be much easier to reason about an application that is data and data authorization on one side, and logic on the other.