It's not usable for cross-domain AJAX requests, is implicit, and it allows for drive by request attacks that must be mitigated with csrf token headers.

Using token auth headers can avoid the use of csrf tokens and make your backend only require a single type of auth.