Send the server a request to change the level and check if the request is valid. Clients should be rather "dumb" as they can always be easily manipulated.