curl -u just requires the field to be there, I suspect. No authentication takes place. You can send any password and the output doesn't change.