HTTP forgets you after every request. Sessions and tokens are how a site remembers who you are, which makes them precious: whoever steals one becomes you.