Ooh very interesting, thanks for explaining!

From reading others replies too, it does looks like client-only mechanism on its own is weak compared to having checks on both the client and server..