secure sessions in login with elgg REST api

Question

I am doing a login form for my elgg (Open Source Social Networking Engine)site with REST api. In ajax request i send email password to method auth.gettoken and in success i get token

How to store auth token in session. I cant use PHP sessions in ajax success right?

Also if i store in HTML5 sessionstorage it can be accessed. Any ideas? Here is code:

$(document).ready(function() {
$("#sub").click(function() {        
var email_id = $('#email_id').val();
var pass = $('#pass_word').val();       
$.ajax({
type       : "POST",
url        : "xxx",                     
data       : {method:'auth.gettoken',username : email_id, password : pass},
dataType   : 'json',
success    : function(response) {               
var auth_token = response.result;

//sessionStorage.setItem("auth",auth_token);
//sessionStorage.setItem("email",email_id);
window.location = '../login_with_elgg/index.php';           
}
});
});
});

Answer 1

I found session storage can be used here. But it can be easily accessed in browser.(chrome)