You shouldn't need your session token in JS, you can specify your fetch requests to include cookies, and you can setup CORS to allow that.