Testing security with client-side proxies