I have another question related to the new HTML 5 Cross-Origin Resource Sharing feature. Is it possible to setup an application using CORS in combination with secured services based on token authentication using ArcGIS for Server 10.1? Does the identity manager support this scenario?
Yes, this should work. Since 10.1 is configured for CORS by default, you should only need to include the identity manager in your app. When a secure service is loaded, the identity manager will prompt the user for credentials.