Comment by nurettin

You give up server redirects and cookie auth. (well you don't lose cookie auth, but you need extra steps for it to prevent CSRF)