The ModelExplorerViewModel is doing a synchronous call to the PersistenceService Login, but that method, in BasicPersistenceService, is actually performing an asynchronous login using EnitityManager.LogicAsync. This works with null credentials because in this sample there's no IEntityLoginManager implementation to validate credentials. DevForce itself accepts null credentials and creates a dummy GenericPrincipal to uniquely identify the user.
To have DevForce enforce user authentication you should implement the IEntityLoginManager interface, and also set the "loginManagerRequied" flag in the ideaBlade.v4 element:
<ideaBlade.v4 version="4.00"
clientApplicationType="Silverlight"
loginManagerRequired="true"
>