[aaronbasssett]

Where is the server getting information about the user's timezone from pray tell?

It doesn't matter if it's being checked on the client or the server. If the user controls what your code sees, they can fake it.

[anamexis]

The user can choose their time zone when they sign up, and the service can prevent them from changing it (or heavily limit how often it can be changed)

[recursive]

It doesn't matter if they fake it. They're only getting one window per 24 hours.

[Tijdreiziger]

Problem: user goes on vacation three time zones west of their usual location, and now they can’t access the site tomorrow.

[recursive]

Worth it.