This system already exists and is Measurement Protcol (https://developers.google.com/analytics/devguides/collection...) allowing you to send activity data via your webserver, so you won't need the javascript tool at all.

The problem is still there however as this is how the spammers send fake data. Essentially, even the server side API is still unauthenticated.