We shouldn't require SessionStorage -- We should only disallow the backend we know doesn't work, CookieStorage. This means its possible to use your own backend that does support safe strings.