thats fine. you can tell them you'd like to work with me specifically if you want 🙂
appId/appSecret should not be thought of as a way to authenticate and access shared content. those credentials are specifically intended to allow an application to access subscription services which burn credits without requiring someone to sign in, or provide information to identify an app which uses an OAuth2 technique to have people sign in with their own credentials to work with private content.
<serverUrl url="http://www.arcgis.com" username="AAA" password="XXX" rateLimit="600" rateLimitPeriod="60" matchAll="true"> </serverUrl>
<link rel="stylesheet" href="https://js.arcgis.com/3.9/js/dojo/dijit/themes/claro/claro.css"> <link rel="stylesheet" href="https://js.arcgis.com/3.9/js/esri/css/esri.css"> <script src="https://js.arcgis.com/3.9/"></script>
<serverUrl url="https://services2.arcgis.com/gGQziFjRK38YOiW5/arcgis/rest/services" username="UserName" password="Password" rateLimit="600" rateLimitPeriod="60" matchAll="true"> </serverUrl> <serverUrl url="https://www.arcgis.com" username="UserName" password="Password" rateLimit="600" rateLimitPeriod="60" matchAll="true"> </serverUrl> <serverUrl url="http://www.arcgis.com" username="UserName" password="Password" rateLimit="600" rateLimitPeriod="60" matchAll="true"> </serverUrl>