Normal arguments are called positional arguments (like method and url in this case). The arguments in braces are optional named parameters:
void open(String method, String url, {bool async, String user, String password})
They are optional, you don't need to pass them if you don't need them. The order isn't important while calling. If you need to pass them, prefix them with the name and a colon. In your case:
request.open('GET', url, async: true, user: theData['userName'], password: theData['password']);