title: Can hidden fields be edited by the user?
body: <p>adding in security questions so that users may reset their passwords if they exceed maximum attempts. is it bad to do hidden fields such as these for authentication mechanism? </p>
  
  <pre><code>&lt;input type="hidden" name="securityAnswered" value=true&gt;
  &lt;input type="hidden" name="exceededAttempts" value=true&gt;
  </code></pre>
  
  <p>could a user go in and edit these hidden fields from the client side? </p>