if a user is on my site's login page, he would have the keys to the secure connection
I don't know what you meant by that...
Client-side protection is more of a help than a protection. If a field on the form must be an email, a client-side email validation will help the user know that the email is invalid before sending the form, and having to probably fill the form all again, while saving on bandwidth and processing on the server-side. But it does not protect the application.
curl, and PowerShell bindings too), and those "access methods" will not care about the scripts you put in place, or not even see them at all.
A user could just fire up
maxlength attribute on form fields, or anything you put in place.
So never trust the client, not even the protections you put on the client-side. It is a time-saving feature, not a protection. Protect the server-side, always.