I don't know how to do this programmatically, but in ArcGIS.com, when you add an item that references a secured ArcGIS Server, it is possible to embed the credentials of the service with the item. So it is possible on the item. I don't believe the credentials get stored in the web map, however.
Thanks,
Mike