This is not true (meaning, it worked for me). Are you sure you used a command something like this?

  $ appcfg.py download_app -A <app_id> <some_folder>

If it doesn't ask for credentials, you should probably add the --no_cookies flag.