Correct, v1’s users/lookup doesn’t require OAuth at this time. It supports it though, which is why that box is there. It’s also strongly recommended. API v1 will cease functioning in March 2013, and you’ll need to move on to using OAuth for API v1.1.