Fixed description of session storage of the ApiKeyAuthenticator

| Q             | A
| ------------- | ---
| Doc fix?      | yes
| New docs?     | no
| Applies to    | 2.4
| Fixed tickets | #4060

I assume the authentication is needed for each request (even if token is stored in the session)
since you can add custom logic in the authenticator.
How about this (trying to make it a bit less technical, but I admit it was a bit tough when I tried to write something different):

>
Even though the token is being stored in the session, the API key (i.e.
`$token->getCredentials()`) is not (for security reasons). To take
advantage of the session, update ``ApiKeyAuthenticator`` to see if
the stored token has a valid ``User`` object that can be used::