Frontend should not store tokens in browser local storage

[why-xn]

It's a security issue to store tokens in browser local storage. Instead, we will use http only cookie which is not accessible from javascript.