If you also include an MD5 hash generated from the contents of your hidden fields, people won't be able to mess with them.