NET authentication service issues an authentication ticket as an HTTP cookie that is compatible with ASP.

The token is encrypted and signed by use of a password and a public/private key pair, stored in an HTTP cookie, and included in all requests for the configured SSO domain.

Using authentication mechanisms outside of the SOAP envelope (such as passing a cookie around) introduces a dependency on a particular protocol (HTTP).