Update API documentation to note session keys