But there are many times when the client _is_ the browser. Are you sure you're not confused by that?
For these clients saving the tokens in the local browser storage is the more elegant option in my opinion, to saving them in a cookie and thus polluting the rest of the browser's requests to that same host.