WASD is viable because for the best player experience the client (the browser) should be simulating actions based on inputs at the same time the server is verifying inputs as valid and sends you appropriate data back.
To put it in perspective, if you are playing a game and we figure on average it takes 100ms (arbitrarily picked this number - no real significance) for you to get a response from the server after pushing a button, as you already know it is going to feel awful to you as a player to wait 100ms before seeing your action occur on the screen ESPECIALLY when it comes to controlling your character.
So as I said, to resolve this you are going to simulate the action on the client as a best guess while the server validates the inputs. So if the player presses W the client knows that usually that means the character should move forward at a rate of 30 units per second and does so. If the player gets snared by a mob after 1 second but the client doesn't hear about it until 1.1 seconds that's ok because the server would have sent data about this snaring at the same time and as a result you can correct the client and put the player as snared in the correct position as opposed to the estimated position by the client. If your client is simulating properly, unless there is major lag the corrections should be minimal and possibly unnoticeable altogether.
Yes this approach means that the player could potentially do some silly client side trickery to make his game client do hackish things, but these hackish things won't actually occur on the server and your server isn't going to send back data that the player wouldn't otherwise normally be able to see because you you've confirmed everything server side. No hacks should get by if you've programmed the systems correctly.
It is my understanding that this is how a lot of games do it and it should work for your game as well. A really good read on this approach has been published by Valve for the Source Engine. You'll find a lot more technical information in that article and much more specific scenarios and other such information that you should find useful.
So to finally answer your question, yes you can implement fluid WASD controls while processing all your data server side (with client side simulation) to prevent hacking. You are not limited to only mouse movement.