I think you should add the map service into the webmap directly by going through
Add>Search for layers> In a Server(select this from the drop down selection) and paste the unsecured service into the search box below it.
Then config the popups like you have done before on the service and save off the map and extract the JSON. Then switch out the URLs(if there is a change to the service url when security is turned on) and create the webmap on your mobile content server.
I did the above and I get the same problem, no popups when the local service is secured. I did not do this yet:
Or doing the Add>From the Web>Enter Service URL(doing it this way you can post in basic and digest secured services into the map)
However the URLs resulting from the first method are no different now than before.
Just for clarity's sake, I am making the local services not-secure by allowing the Everyone user in the service permissions with the popup layer. I invoke security by removing the Everyone user which then requires that I enter credentials as the iOS map loads.
Note, the last JSON I got from ArcGIS.online was version 1.4, yesterday it was 1.3.
Still can't get popups under secure services.
Eric