I have a question about working with secured feature services in the Quick Report App. I thought adding the username and password into the appinfo.json file under properties would work,
"properties": { "password": "password",
"username": "username",
but I get this error:

I can get the app to work by plugging the username and password into this line in FeatureServiceManage.qml under the generateToken function:
var obj = {"username":"username", "password":"password", "f":"json", referer: "http://www.arcgis.com"/*, expiration:"1"*/};But my guess is that’s not how it is supposed to work. Am I missing something?
I am using AppStudio for ArcGIS (Desktop Edition) 1.4.18 and the Quick Report template.
My app is for the public to submit sensitive information to a public safety customer. So I need for the public to be able to edit the feature service, but I do not want the public to be able to access the rest endpoint of my feature service.