Indeed, for callbacks and such I find it good to just think of the web browser as just another web service client calling an API: that's where you draw your line of trust (your own code running in your own environment).