Ben,
Try to specifically set authentication type to token:
AGSCredential *cred = [[[AGSCredential alloc]initWithUser:@"" password:@"" authenticationType:AGSAuthenticationTypeToken] autorelease];
If that doesn't work, can you validate your tokenurl?
Use this link: <GIS SERVER URL>/arcgis/rest/info?f=pjson
There should be a parameter called token url. You should verify that the url in this field is reachable. If it is incorrect, you can set it when you build your credential. It most likely should be:<GIS SERVER URL>/arcgis/tokens.
Example:
AGSCredential *cred =
[[[AGSCredential alloc]initWithUser:@""
password:@"" authenticationType:AGSAuthenticationTypeToken tokenUrl:tokenUrl] autorelease];