I have a REST based service architecture. One service is used to login users. A successful login request results in a auth_token sent back to the web client. 
I would like to store the token in localStorage which is working fine in most situations. However it is possible that the user disables localStorage or the browser is in private mode (as far as I know only an issue on Safari). 
My question is: Is there any concept I can use as a fallback when localStorage is not available? 
Is storing the token in the window variable an option? 
Any ideas are appreciated.