[Feature]Separate FrontEnd variables and BackEnd variables

## Summary

For pages that are meant to be accessed by different users, we do not want the user to mess with some key variables.
For example, if the user is logged in as a@a.com and we only display all the data related to this account by filtering via parameter in API call, we obviously do not want the users to tweak this to b@a.com to peek data for a different user.

However, after seeing the network call for an API request with embedded variable, it is noticed that apparently all the parameters for APIs are passed from FE. For applications that require strong security, this makes them unusable.

I suggest that there should be some mechanisms that separate FE and BE variables. This might need some redesign but have the following benefits:

* Some sensitive variables are totally not tweakable from the FE. For example, the current logged users, permissions, etc.
* Some other data that require user selection, for example, items in the drop-down list, can be keyed. So only the key is stored. Actual values are in BE and will be transformed automatically. This also prevents a certain degree of tampering.