I need to protect URL alias from being submitted.

I've tried setting #disabled, #access, unset(), and what not. It hides the form, but the user is still able to modify the form on the client-side and submit it.

How do I prevent this form from being submitted on the client-side?

My current module code

<?php
function mymodule_form_alter(&$form, &$form_state){
  if (empty($form['type']['#value'])) return;
  $form['#after_build'][] = 'mymodule_after_built';
}

function mymodule_after_built($form, &$form_state) {
  $form['path']['#access'] = FALSE;
  $form['path']['alias']['#access'] = FALSE;
  $form['path']['alias']['#value'] = $form['path']['alias']['#default_value'];

  return ($form);
}

I need to protect URL alias from being submitted.

I've tried setting #disabled, #access, unset(), and what not. It hides the form, but the user is still able to modify the form on the client-side and submit it.

How do I prevent this form from being submitted on the client-side?

My current module code

<?php
function mymodule_form_alter(&$form, &$form_state){
  if (empty($form['type']['#value'])) return;
  $form['#after_build'][] = 'mymodule_after_built';
}

function mymodule_after_built($form, &$form_state) {
  $form['path']['#access'] = FALSE;
  $form['path']['alias']['#access'] = FALSE;
  $form['path']['alias']['#value'] = $form['path']['alias']['#default_value'];

  return ($form);
}

UPDATE:

To clear the question, I am not asking how to hide the form, but how to prevent the end-user from manually altering the code and submitting the form I just hid.

End-user can just edit source code and add <input type="text" id="edit-path-alias" name="path[alias]" value="" size="60" maxlength="255" class="form-text"> and still enter the alias.