Right, actual form validation for security should of course be done on the server to clear up potential confusion.

Form check-pointing is another good example of Javascript use. It has never bothered anyone that a webpage is saving your form on the client or server in the background.