Kerberos Authentication flow

In the network trace, you mention that the first AS-REQ fails because it's not encrypted.

Earlier you mention that the AS-REQ packet includes the username, and could include the users password.

Would the users password be part of the "plaintext" AS-REQ packet, or is the protocol smart enough to only send that information as part of an encrypted packet?

It has been my belief that one of the benefits of Kerberos over older authentication flows was that usernames and passwords were encrypted in the Kerberos authentication flow.