1. If you don't install any extension, which provides a service and therefore makes your microcore "available" from outside (like SSH in openssh, VNC in x11vnc, etc.), you don't need to protect it by setting a password. But even when you e.g. install openssh and start it, it won't let you login as long as there is a valid password for such user (at least it should be that way, there were some irritations last year with the openssh extension).
2. To login with a password everytime you start:
a) Start microcore, run: $ sudo passwd tc, enter new password
b) Edit /opt/.filetool.lst to include "etc/passwd" and "etc/shadow", run $ filetool.sh -b sda1, replace sda1 with the drive where you want to save your backup
c) Add boot codes to your microcore boot loader config file at the kernel line, e.g. menu.lst: change kernel /boot/bzImage quiet to kernel /boot/bzImage quiet noautologin restore=sda1, replace sda1 with your partition you used for backup.
d) reboot. If you are using an USB key as your drive then additionally add waitusb=6 as a boot code.