Try to make thin client really thin. I've always had a temptation to quickly add more and more JS logics, but the more I did it, the more I realized that I took the wrong route. My opinion is that it is OK to have very simple logic implemented with JS, but anything which is a bit too much is too much, and I tend to implement it with server side code. Security and such are special case - any credential should never leave the server (should not travel back to client) and client should never send them more then once to the server during one session.

Igor.