I've added a hosted tile layer to my AGOL map and now my WAB Developer app (v2.8) asks to sign in for each secure layer in my map (coming from my AGS)! Without the hosted tile layer in the map, I only have to sign-in for the secure layers once.
Looking at the network traffic, each GET request to AGS is using the correct token but the sign-in window is still displaying for every layer. Also, the problem only seems to happen with a clear cache.
Can anyone think what would cause WAB (tokenUtils.js?) to keep asking for credentials, and why it would be caused by having a hosted tile layer in the map!?