Add caution when returning null from createToken()

Author: Jeroen Seegers

cookbook/security/api_key_authentication.rst

@@ -109,6 +109,11 @@ will cause authentication to fail. You might want to return ``null`` instead
 to just skip the authentication, so Symfony can fallback to another authentication
 method, if any.
 
+.. caution::
+
+    In case you return ``null`` from your ``createToken()`` method, be sure to enable
+    ``anonymous`` in you firewall. This way you'll be able to get an ``AnonymousToken``.
+
 2. supportsToken
 ~~~~~~~~~~~~~~~~