I store my session token in a cookie, which is even worse because it's sent with every request.