Where is the server getting information about the user's timezone from pray tell?

It doesn't matter if it's being checked on the client or the server. If the user controls what your code sees, they can fake it.