Hello,
I have the same problem with Application Server 9.1u2. The admin console don't ask any login/password and give full config access to anyone which know the admin port.
Did you found a solution? I did not change anything special. It's like this since the installation I think.
Vincent
[Message sent by forum member 'vvlier' (vvlier)]
http://forums.java.net/jive/thread.jspa?messageID=320797