Yes that is convenient sometimes but if you are building a multicustomer environment with locales and AD integration it would be nice to be sure that everything is indeed secure.
You are correct that the emulator doesn't support authentication today, as in passwords that are configured in the emulator aren't checked today. You can test locales thought (without AD of course). Create any user, with a locale defined, and if user say "bob" was created w/ locale "test", when you log into the emulator today w/ a created user that is defined (no matter what the password is) with a particular role, that user will get the role you had set. We have AD integration and true authentication on the roadmap for a future release of the emulator.
Eric