I am a little confused about the difference between two ways of
implementing impersonation.

Some sources say that if one needs to run application under a specific
account, he should use this
<identity impersonate="true" username="username" password="password" />

Others state that the impersonate attribute should be set to false and
username and password then have to be provided as in:
<identity impersonate="false" username="username" password="password"
/>

What's the difference?