An application validates a user in the browser but does not enforce authorization on its API. What is the primary weakness?

1. The database must use a shorter password
2. The application requires too much encryption at rest
3. The browser has too many tabs
4. Server-side operations can be invoked outside the browser's checks