Cheating using modified clients is hardly unique to HTML5 games, and the solution is the same everywhere: move game logic decisions on the server and only have the client predict those decisions while it sends its own choices to the server. The problem with Agar.io etc. is maybe that they don't have a sound multiplayer model designed with cheating in mind, or that the cheats concern things that the server can't control, like client decisions (e.g. aimbot) or client presentation (e.g. wallhack).