update stan

Fix deprecation errors

The `identify` option only verifies that the username exists in the
database, it does not verify passwords as the documentation previously
suggested. This makes it ineffective for the use case of detecting
password changes or remotely invalidating sessions.

Users should use `PrimaryKeySessionAuthenticator` instead if they need
to fetch fresh user data from the database on each request.

Also updated the Quick Start guide to clarify that SessionAuthenticator
does not need an identifier - it uses session data directly as identity.

Deprecate SessionAuthenticator identify option