bitcoin.conf does nothing for RPC calls
I'm suppose to set rpcuser, and rpcpassword on bitcoin.conf file on .bitcoin folder. Right?


Kind of. rpcuser and rpcpassword have been deprecated in favor of cookie authentication (temporary username and password placed in the .cookie file) and rpcauth.


  Well, when I do so I still can call bitcoin-cli without prompting any password,


It's not supposed to. bitcoin-cli reads the data directory to get the information it needs. It will read your bitcoin.conf file for the username and password or it will use the .cookie file.


  the code does not work


Your code is completely wrong.


serverURL = 'http://' + rpcUser + ':' + rpcPassword + '@localhost:' + str(rpcPort)



This is incorrect; that's not how authentication works for this.

Bitcoin Core uses HTTP basic auth; the username and password are not part of the URL like that. Since you are using Python Requests, here is their documentation on using HTTP Basic Authentication: http://docs.python-requests.org/en/master/user/authentication/#basic-authentication