Additionally, cookies can be marked as http only or even as secure, making it very hard to lose the token by virtue of a fire sheep like, or even just XSS attack.
For that reason, I personally would prefer a site using (session) cookies to one hacking it via DOM storage any day.
And finally, depending on the store you might want to persist the shopping cart between visits- likely across machines. Thus, the cart should be stored on the server and not in DOM storage.
When you set a cookie with a Set-Cookie header, the client will automatically send the cookie with all further requests.
When you put the session-ID somewhere in DOM storage, you have to manually amend all requests with that session-ID - either by appending it as a get parameter or, when you do nothing but AJAX, as an additional request header - but whatever you do, it's considerably more effort.
Also, looking at our logs, I see way more users with DOM storage disabled than with cookies disabled, but that might just be my user base.
That last bit about your logs is surprising, thanks for that bit of info. I may need to go do the same. Either way I use a storage wrapper so I am accommodating both types of users.