Fixed description of session storage of the ApiKeyAuthenticator

| Q             | A
| ------------- | ---
| Doc fix?      | yes
| New docs?     | no
| Applies to    | 2.4
| Fixed tickets | #4060

I assume the authentication is needed for each request (even if token is stored in the session)
since you can add custom logic in the authenticator.
What do you think about my update?

>
Even though the token is being stored in the session, the credentials,
in this case the API key (i.e. $token->getCredentials()) are for security
reasons not stored in the session. To take advantage of the session,
update ApiKeyAuthenticator to see if the stored token has a valid User
object that can be used::