it makes them completely inaccessible to client side JavaScript

Dude literally said to do this for browser clients, and only support bearer tokens for non browser clients.