AGOL security works, but AGS security does not. I believe Frank is doing the same thing we would like to do. He using a secured service in AGOL but instead of securing the AGOL map with stored credentials he is only securing the services in the map. The app is trying to resolve the data from the REST endpoint but instead of prompting for the credentials it goes in to a holding pattern. Oddly, AGS security works in WAB developer edition but once the app is extacted and placed on a webserver the application hangs instead of asking for credentials. I am planning to call esri support about this tomorrow to try to get it resolved, or at least logged as a bug.
