Authentication type in DD paragraph confusion

Question

Hi,

Could anyone please tell me why the following paragraph is incorrect:

If your deployment descriptor correctly declares an authentication type of BASIC, the container automatically requests a user name and password whenever a user starts a new session.

Answer 1

Because container would only request (as in "send an authentication challenge to browser") user name / password when user attempts to access a protected resource (as defined in descriptor); not when user session is created.

Details are in JavaEE tutorial