Comment by szmarczak

That's why I wouldn't say the below.

> A lot of times local storage is much less secure

Without XSS, local storage is actually more secure. You don't have worry 'did I set up this right' because there is nothing to set up and CSRF is impossible to execute.

If you're still paranoid about XSS, CSP is your friend. Also check isTrusted on events.