the problem is that I can't do this with ajax requests, they must always be on the client side. I thought about obfuscating and discovered that it's not so secure either