Fixed description of session storage of the ApiKeyAuthenticator

| Q             | A
| ------------- | ---
| Doc fix?      | yes
| New docs?     | no
| Applies to    | 2.4
| Fixed tickets | #4060

I assume the authentication is needed for each request (even if token is stored in the session)
since you can add custom logic in the authenticator.
Yea, much closer. I want to change just one more sentence. The `-` is a bit more clear to me than the `,` and changing the order of the "security reasons" and "not stored in the session" sounds a bit more clear to me:

```rst
Even though the token is being stored in the session, the credentials - in this
case the API key (i.e. ``$token->getCredentials()``) - are not stored in the session
for security reasons.
```