title: What's the most secure way to store a jwt and still be able to access it from javascript?
body: <p>I'm working with Flask and restful API to handle my user management calls. 
  Example scenario:
  Let's say I'm using JWTs to secure my reset password end-point.
  I experimented with a less secure method, for now, where I grab the token as a part of the response from the previous endpoint, and pass it as a bearer token, I still happen to get a 401 Unauthorized error. Although, I can see from client-side debugging, that the token is getting passed in the header. Ideally, I want to send a post request with Authorization HTTP header and Bearer Authentication scheme and pass this token from the httponly cookie. </p>
  
  <p>The following are the questions I have:</p>
  
  <p>Should I store the token in an HttpOnly Cookie or Localstorage?
  If I'm using an HttpOnly cookie, how can I access my token from inside the ajax call? 
  What's the best way to use JWTs for user-related functionalities (like reset password, email confirm, etc) other than auth?</p>
  
  <p>I want to ensure I don't compromise on security standards while I accomplish all this.</p>