Like there's a reason we invented cookies and all mature web frameworks use them for auth.

Cookie stealers, issues with third-party cookies and tracking... it's not like the past was a paradise, in fact, quite the opposite. Hell I 'member times when we had to append ?PHPSESSID=... to URLs. Cookies were a stopgap...