From the accepted answer:

> With a cookie you can set the http-only flag, which prevents the application from reading the cookie after it is set. As a result, in the event of an XSS attack, the attacker can still make calls on your behalf, but they can't walk away with the authorization token all together

This is a weak argument for localStorage vs cookie IMO. Practically speaking, isn't it mostly the same ? If the attacker is able to access your localStorage and send a request with the token to his own server, he most certainly can send requests on your behalf to the application server through that same XSS. So cookie or storage, you're compromised.
@bobince have explained that with better words : https://security.stackexchange.com/questions/43529/does-setting-httponly-prevent-stealing-a-session-using-xss

XSS is application level vulnerability, but its effects can be mitigated by limiting the power of the token through the usage of claims (restrict to minimum necessary)

Therefore use the token through storage/header to have CSRF protection at least.