I don't know why suddenly we are talking about
Tomcat? Apache and Tomcat are 2 different servers and Tomcat doesn't need Apache or PHP to run.
The default page of Tomcat shouldn't need a username/password. Only if you want to look at application listing then it prompts. And yes tomcat-users.xml is the place to set passwords.