STS and LocalStorage (vs cookies) for more security