Web applications give different users different rights. An ordinary account might be allowed to edit its own profile while an administrator can manage other accounts. Authentication verifies a claimed identity, and access control enforces what that identity is allowed to do. Those limits have to hold even when the user making the request would much rather have someone else's privileges!
Those decisions belong on the server, where they have to hold for the requests a client actually sends. A browser can ask for a different resource or claim a different identity, and a hidden button does nothing to stop that request from arriving. If the application trusts the claim or misses a permission check, an ordinary user can gain access that was never meant for them.
