Spaceport looks very promising, thanks! I might just give it a try some time. Roar engine can be combined with construct, as it's simply an API to "socialize" your game (I guess leaderboards, in game shopping, etc.). All about accessing their online API then rendering the response, then adapting this data to your game.
More generally speaking, yeah social games can be created in construct, however not natively... Shouldn't be all too difficult though with good, working knowledge of JS as you can write your own plugins and so on (tha a look at now.js: http://nowjs.com)
"Never trust the client" as they say haha. Anything on the client side can be exploited, manipulated, etc. Is it a single player game? Easily hackable and there's really nothing you can do about it. Multiplayer? Make your server the end authority point and validate each and every request (still, cheaters will be cheaters and cheating will still happen).