Deprecate SessionAuthenticator identify option

[dereuromark]

Summary

• Deprecate the identify option in SessionAuthenticator
• Simplify the Quick Start example to not pass unnecessary identifier to SessionAuthenticator

Why deprecate identify?

The identify option only verifies that the username exists in the database - it does not verify passwords as the documentation previously suggested.

When identify => true:

• The default fields config only includes username, so only the username is passed to the identifier
• The PasswordIdentifier::identify() method skips password verification when no password credential is provided
• Even if you add password to fields, it fails because sessions store hashed passwords, but password_verify(hash, hash) doesn't work

This makes the option ineffective for:

• Detecting password changes
• Remotely invalidating sessions when passwords are updated

Users should use PrimaryKeySessionAuthenticator instead if they need to fetch fresh user data from the database on each request.

Quick Start example improvement

The SessionAuthenticator doesn't need an identifier by default - it just uses session data directly as identity. The example was unnecessarily passing $passwordIdentifier to it.