you cannot trust ANY information from a client