sessionStorage won't work across tabs. You have to encrypt sensitive data; I use securecookie [0].

[0] http://godoc.org/github.com/gorilla/securecookie (Go)

Hmm....

Could you use sessionStorage to hold a temporary key for decrypting whatever is localStorage?

Yes, there are potential security issues with this, but as with anything in the browser you need to think through where your secrets are held. A similar issue comes with setting an expiry time of a few hours on a resource to let the browser cache it, so it's something web developers have been battling against for years.