DOC Add information regarding Security::setCurrentUser()

[emteknetnz]

Issue silverstripe/recipe-cms#47

[maxime-rainville]

I think we need to give people a bit of an overview about where the problem is coming from before digging into what the solution is. We should also be explicit that what they were doing before was wrong.

I don't think we need to go into the details of how you would log a user into the regular logic. If you call setCurrentUser in your actual code thinking that this would survive into the next request, your site is already busted with or without session manager.

Suggested change

	#### Important information regarding Security::setCurrentUser($member)
	When the session manager module is installed, any custom code calling `Security::setCurrentUser($member)` before creating a mock HTTP request, notably `FunctionalTest::get()` and `FunctionalTest::post()` will need to be updated. Functional tests should be updated to `$this->logInAs($member)` and `$this->logOut()`, while regular application code should be updated to `Injector::inst()->get(IdentityStore::class)->logIn($member);` and `Injector::inst()->get(IdentityStore::class)->logOut();`. Code that is not creating a mock HTTP request should be able to continue using `Security::setCurrentUser($member)`.
	#### Test should not use `Security::setCurrentUser($member)` when mocking HTTP request
	When writing automated test, you can use `FunctionalTest::get()` and `FunctionalTest::post()` to mock HTTP requests. Until now, developers could abuse the `Security::setCurrentUser($member)` method to define which member those mocked requests would run against.
	`Security::setCurrentUser()` is *stateless* ... its effect only last for the current request. When mocking an HTTP request, session-manager logs out the mocked user if it was defined with `Security::setCurrentUser()`.
	Your tests should use `$this->logInAs($member)` and `$this->logOut()` when mocking HTTP requests. It is still appropriate to use `Security::setCurrentUser()` when testing stateless logic. e.g.: Testing that a `DataObject`'s `canView` method returns the correct value for the current user.
	Review the [Functional Testing developer documentation](/developer_guides/testing/functional_testing/#loginas) for more details on `logInAs()` and `logOut()`.

[emteknetnz]

I've taken you suggestions and made some slight tweaks to them. It still has all the same points.