I'd argue that doing proof-of-possession for state maintenance/session persistence, rather than simple bearer tokens, is sorely needed.