Defending bot-detection code that runs on the attacker's own machine