A web API trusts a role value supplied in the client's request and grants administrator actions when it is changed. What is the primary fix?

1. Base privilege solely on a hidden form field
2. Use a longer role parameter name
3. Enforce authorization server-side using trusted identity and policy
4. Encode the role value without verifying its integrity or authority