Fixed description of session storage of the ApiKeyAuthenticator

| Q             | A
| ------------- | ---
| Doc fix?      | yes
| New docs?     | no
| Applies to    | 2.4
| Fixed tickets | #4060

I assume the authentication is needed for each request (even if token is stored in the session)
since you can add custom logic in the authenticator.
This is exactly the same return as above. Can't we do something like below?

````php
$user = $token->getUser();

if (!$user instanceof User) {
    if (!$username) {
        throw new AuthenticationException(
            sprintf('API Key "%s" does not exists.', $apiKey)
        );
    }

    $user = $this->userProvider->loadUserByUsername($username);
}

return new PreAuthenticatedToken(
    $user,
    $apiKey,
    $providerKey,
    $user->getRoles()
);
````