So you’re saying if I log into HN, every intra-site link should be rendered with “?token=<secret>” and if I send a link to a friend it will let them be logged in as me?

No, because that would be ludicrous, cookies are obviously necessary for the concept of a “login” or even just a “session” to exist.