docs(session): document session:table --uuid and the APP_KEY effect on AuthenticateSession

versions/4.x/authentication.md

@@ -235,6 +235,8 @@ auth()->refreshSessionFingerprint();
 
 The middleware does not read the password from the database by itself. A password that changed there while a request was running may have been changed by another device that is signing this one out, and the middleware must not keep this device signed in.
 
+The middleware identifies the password a session was signed in with by a fingerprint keyed with your `APP_KEY`. Changing `APP_KEY` therefore signs every session out on routes that use the middleware, just as it already makes encrypted cookies, including remember-me cookies, unreadable.
+
 > **Note:** The middleware is optional with the `database` driver, which deletes the other sessions immediately. Registering it anyway also covers password changes made outside `logoutOtherDevices()`.
 
 Sessions that were signed in before the middleware was registered do not record which password they were signed in with, so registering it signs them out on their next request. Only the sign-in ends: the rest of the session's data, such as a shopping cart, is kept. A device with a valid remember-me cookie is signed straight back in, so only users who did not choose "Remember Me" have to sign in again. A remember-me cookie that `logoutOtherDevices()` has replaced does not sign the device back in.

versions/4.x/session.md

@@ -125,7 +125,7 @@ Schema::create('sessions', function (Blueprint $table) {
 | `payload` | The session data, serialized and base64 encoded |
 | `last_activity` | When the session was last used, as a Unix timestamp |
 
-> **Note:** If your users have UUID or ULID keys, change the `user_id` column to `$table->string('user_id', 36)->nullable()->index();` before you migrate.
+> **Note:** If your users have UUID or ULID keys, generate the migration with `php pool session:table --uuid`. It creates `user_id` as `$table->string('user_id', 36)->nullable()->index();` instead.
 
 The table and connection default to `sessions` and your default database connection. To change them, add these options to `runtime/config/session.php`; `connection` must name one of the connections in `runtime/config/database.php`:
 
@@ -382,7 +382,7 @@ Removes every stored session, which signs out all users. It has no effect on the
 php pool session:table
 ```
 
-Creates the migration for the `database` driver's table. See [Database Driver](#database-driver).
+Creates the migration for the `database` driver's table. See [Database Driver](#database-driver). Pass `--uuid` when your users have UUID or ULID keys, to create `user_id` as a string column.
 
 ## Concurrent Requests