I didn't use localstorage because of the lack of sharing between protocols and subdomains, but the points you listed are valid concerns.