Document DAST cookie handling

doc/user/application_security/dast/index.md

@@ -183,6 +183,10 @@ To create masked variables for the username and password, see [Create a custom v
 Note that the key of the username variable must be `DAST_USERNAME`
 and the key of the password variable must be `DAST_PASSWORD`.
 
+After DAST has authenticated with the application, all cookies are collected from the web browser.
+For each cookie a matching session token is created for use by ZAP. This ensures ZAP is recognized
+by the application as correctly authenticated.
+
 Other variables that are related to authenticated scans are:
 
 ```yaml