Correct me if I'm wrong but the benefits sound very similar to a good old fashion cookie except that you're not limited by 4kb.
If the token is cracked, it is essentially the account compromise. You probably meant the base64 decode if the token is 'leaked'?