ApiKeyAuthentication Security Issue

ApiKeyAuthentication assigns user to request object basing only on
username checks what will change current user to any provided through
username value.

For example, if we would use MultiAuthentication in combination with ApiKeyAuthentcation + SessionAuthentication this will allready passes us as authenticated user if we specify only correct username.