> The problem is...well I still don't really know how I should be including that? It's so much easier just to register a session cookie from a login page.

For a webpage this makes perfect sense, where would you securely store an access / refresh token on web that isn't vulnerable to XSS? In a session cookie that is secure & http only...

For native apps though that state might be more annoying to track and a auth token and refresh token is pretty easy to store securely.