During a web application assessment, a penetration tester accesses the site unauthenticated and receives the following Set-Cookie on the first response: auth=yY...