Tokens in memory only (the default, and what the browser-based apps BCP recommends): nothing persists, so a page reload means signing in again, and nothing is left behind in storage for injected script to read later.
Tokens in memory only (the default, and what the browser-based apps BCP recommends): nothing persists, so a page reload means signing in again, and nothing is left behind in storage for injected script to read later.