Or the other way around, you keep as much as you can on the client but use nonces in critical requests to prevent (accidental) replays.