Time travel badge ftw.
Truth is, its javascript so its pretty easy to cheat anyway, variables, and webstorage call all be accessed in browser.
Your guess of using a server is about the only decent solution, but they will still likely cheat.
The time spent trying to prevent it would be better used to pander to it.
In other words use the bad habits to your advantage.