Consider security issues that the library can help with

[possibilities]

• CSRF: feels like there's not a lot we can do to help
• XSS: also seems like there's not much help we can offer other than allowing the access token to be omitted on the client (we already set the cookie to HttpOnly), see Make access token exposition optional #22.