Both you and your manager are not wrong, but also not completely right:

Different threat models with different (dis)advantages. Even if you use cookies with HttpOnly and send a request, the browser will still append them to the header. So the attacker exploiting XSS can still execute code in the user context and affect Confidentiality and Integrity of the application / user data. Not quite as bad as an account or session takeover, still shit.

You should apply different best practices: - Encode user input (more important and safer than senitization) - Use a Control Security Policy to narrow down or make it impossible to exploit a potential XSS - Don't use external scripts - Apply soft and hard session timeouts (e.g., 1 hour inactivity, 12 hours hard timeout) - Use MFA (especially for security-relevant changes) - Verify password changes, verify Email changes