Actually this is how the chromecast works. You never interact with the chromecast directly to configure your Netflix account for example. I assume (hope) they send a URL to the movie it should play with a one-time token to access the movie source.
There's no need for a plain username+password to be used... it's just an authentication token as the resource or part of the url.