For a semester exam, which option is correct about complete mediation?

A. skipping server-side checks B. checking authorization every time access to a resource is requested C. checking access only at login forever D. trusting hidden form fields