It is checked server-side. I understand why people are concerned that the price is passed in a way that they can see vs grabbed via javascript or another method like most other sites, but that doesn't change the responsibility to check the data server-side. I can edit my POST requests to Amazon but they better not sell me stuff for $0, and neither will this site.