Security is more my focus than UX (although I am not myself a "security professional"), and I neither agree nor disagree with the thesis of the article. I think

Security is more my focus than UX (although I am not myself a "security professional"), and I neither agree nor disagree with the thesis of the article. I think the right answer is the classic "it depends". Specifically, it depends on how bad it would be if a session token is leaked, how the rest of the authentication system works (can session tokens be revoked, what is required to refresh a token, how long is the absolute expiration of a token, etc.), and even whether the user is using a public computer or not. That said, the arguments in this article makes many dangerous assumptions. Such as assuming that users never use a shared computer (like say the computer in a library), and that you can completely reliably avoid tokens from ever accidentally getting logged.