Fixed description of session storage of the ApiKeyAuthenticator

| Q             | A
| ------------- | ---
| Doc fix?      | yes
| New docs?     | no
| Applies to    | 2.4
| Fixed tickets | #4060

I assume the authentication is needed for each request (even if token is stored in the session)
since you can add custom logic in the authenticator.
I know this is quite common in Symfony source, but can you please split this in 2 lines: One with the definition of `$user` and one with the if condition? The current method is less readable, which isn't a good thing for documentation examples :)