I am currently creating a website which users can view and modify their widgets. All interation with the widget data stored on my server will be done through RESTful web ser
I don't know much about security, but i think it all depends on how much time/cost you are willing to spend (keeping in mind that everything is hackable).
As concerned of security as you are, you probably protected your session variables, the easiest thing you can do is an ajax call to a server action in which you check for the session and compare it with user request.