If you're already logged in through minecraft.net, and you change your username. The "Verify with password" field isn't checked, meaning you can submit text that is not your password and the request will still go through just fine.