When adding a secured service URL as an Item in ArcGIS Online, the checkUrl.jsp page is called with the service URL passed in as an argument. That part makes sense as AGO needs to interrogate the service endpoint to figure out its capabilities.
However, the request also passes along a token.
I am wondering where that token comes from, since there is no request to the ArcGIS Server's token endpoint, and what function it plays when validating the target service URL.
