secure, httponly cookies exist and just might help in easing that pain point.