If we're saying going to the KISS route, then the bigger Auth service should just implement native session storage. SessionStorage was intended to support either cookies or session storage depending on user preference, if it's just going to support one of them, we made it unnecessarily complicated so not KISS.