I have read the Salesforce documentation about username/password authentication here:
and it seems that defining a connected app is mandatory as well as including the secret and its key in the headers of the http request. It appears however that some libraries, such as https://pypi.python.org/pypi/simple-salesforce are not requiring a connected-app for the username-password oauth flow.
How is this possible?