The Collector as the ArcGIS app loads well a WebMap secured within ArcGIS Online. That is achieved through the generateToken REST call using the www.arcgis.com domain name.
However, both the Collector and the ArcGIS app cannot seamlessly load an ArcGIS for Server secured service (Token or Windows based). Can't you guys loop through the layers from the WebMap after the ...items/webmapid/data request and challenge each distinct ArcGIS for Server generate token endpoint using the credentials I have inserted in the login ???
