Every protected action checks the session on the server before returning data. UI-only access control is theater — a crafted request bypasses it in seconds. Hiding a button is not access control.