When I sign into ArcGIS online normally it doesn't care about case sensitivity in the username (ie: "userName" and "username" both work).
When I add an ArcGIS online secured service to my custom 4.11 application the username needs to be correct (ie: "userName" works and "username" doesn't).
Is this a bug that can be configured? Some of our users who sign into ArcGIS online everyday with "username" don't even know that their password is "userName".