Any results from an automated scan should be followed up with manual testing to confirm or deny a result.
Also, without knowledge of exactly what your application does it hard to determine the impact some of these vulnerabilities would have but generally I would not allow an app into production with some the the problems detected in the scan such as XSS, CSRF and Cookie flags.
You have to determine what your application does, the data it uses and actions that can be performed through it and then understand the vulnerabilities and how those can impact your users and data.
I would not dismiss a vulnerability just because it was found with an authenticated scan, especially if anyone can register/sign up through the application. You definitely want to have multiple layers of defense.
I recommend do some manually testing to confirm these and if they are confirmed put measures in place for XSS, CSRF, cookie flags, click jacking but again you have to determine your own risks based on your application