Good luck - there's a lot to this! You might find more help in the AGS server forum. You should be OK with just version 10.1. We skipped over that version actually, but what we did in 10.0 compared 10.2 really hasn't changed. You'll find documentation in the AGS Help, more than looking through the API documentation.
You'll need to set up https and a proxy because now you're dealing with passwords and security.
You will need to modify both your map service and your application. In ArcGIS Manager, you'll see a place to specify users and roles. Think of roles as groups that users can belong to. I've set up a generic role and user before and had multiple users all authenticate with this generic user. This may or may not be an acceptable solution for you.
Once you have the user/roles set up, go the services and use the 'lock' to secure the service to a particular user. Now you won't be able to see this service at the rest endpoint without credentials.
In the API, look at IdentityManager. Once you have a proxy, only https request in your code, adding IdentityManager will automatically trigger a login. The user can enter the credentials set up in the steps above. IdentityManager only locks layers, not the whole application. The map still initializes, just stopping when it encounters a secured layer. The user can't proceed with loading the rest of the map until they've authenticated.
It gets more complicated from there. Some people don't want the map to start loading at all without some sort of authentication. We use active directory and there's a whole other level of settings that have to be put in place if you want to have their existing OS account manage whether or not they can access a map.
You have a lot of reading ahead of you - this isn't the easiest thing to wrap your head around.
