Hi Vincent,
If your application was built using one of the "Business Application Templates" it will do an automatic login with a null credential when the application starts. This is done to "load" any currently logged in user, or for a persistent cookie. If you don't want to support this feature you can turn it off by removing the code in the Application_Startup method in app.xaml.cs which calls AuthenticationManager.Current.LoadUser.
If your application wasn't built using the BAT, then check your client-side code for any EntityManager constructions. If you have multiple EntityManagers in your code but only explicitly login on one of them, any others will pass null credentials to the login manager when they login.