[locci]

This is one of the reasons javascript should be used both on the server and the client.

The server would offload as many procedures to the client as possible (that is none if js is disabled, some if you don't want to expose your guts).

The server html renderers would be the exact same code in the client, the api would be a simple thin wrapper around your "protected" procedures.

You could event support ecmascript5 features on IE6, executing the js in the server.