The *config.api_only* field must also be set to false for the session management configuration to kick in

If you only fill in the `config.session_store` and leave `config.api_only` as true session management will not be turned on. Updating docs to reflect this behaviour.