If you are building your own login ui using our session api, it is up to you how you build that flow, if you only want to check for the username/email address thats fine, you just need to accept a token with only those checks,
the documentation might be alittle confusing there. the password is not requried, but if you send the password object, then you need to fill the password attribtue