If you have an xss your problem is much bigger than leaking an ephemeral access token through localStorage