While I certainly don't disagree with what you said. I think you need to look at his arguments as a way to protect user data. Not all users that use your "medio

While I certainly don't disagree with what you said. I think you need to look at his arguments as a way to protect user data. Not all users that use your "mediocre" technical solution are aware of how "mediocre" it is. And if tokens are sent with GET requests or whatever stupid thing.