The first is actually the "correct" usage but it was not supported in the codebase at first and was still the way an awful lot of Catalyst in the wild worked while many tutorials and documents reflected the newer namespaced style.

Catalyst::Plugin::Session suffered from this same problem; i.e., "session" worked and "Plugin::Session" didn't and I'm pretty sure there was an interval where the docs and code clashed; i.e., docs said "Plugin::Session" but only "session" worked.

Ir all seems good now. The current versions of the various auth and session pieces work fine with the namespaced keys. The plain plugin keys -- "authentication," "sesison," etc -- are deprecated so it would probably be better to upgrade your modules than to cater to the old style.