When you browse to a CFC, CFCExplorer will run to show you a Javadoc-like generated documentation. That's why you see that login page.
The code in your CFC got executed is just a side effect of CF instantiating your CFC to inspect its content.
You generally want to do the code execution in a CFM, with CFC used to handle your OO things.
One exception might be foo.cfc?method=someAjaxMethod&Arg1=bar
, for invoking remote method by ajax.