I'd be interested in an expansion of the server-side token storage step. Are there particular security-related concerns to look out for when transmitting the token, since the app is entirely client-side?