Whether authentication is enabled or not is irrelevant.
If your authentication chain allows users to authenticate against an external system then there is no need to send the user name and password, and to do so would be a major security flaw. Only if the account is being generated on alfresco for the first time is a username and password sent (otherwise how could the user know what their user name and alfresco specific password is.)