Possibly it's changed as you suggested, but how can he expect to receive the passportprofile and passportticket without first sending a password?
The passportticket and passportprofile can be used to log you into almost any MSN website, so I don't imagine they'd now allow you to get it without connecting to the authentication server first, and even if you can now use the normal servers for auth, you would need to send the password somewhere, wouldn't you?
