I host ArcGIS Server 10.0 SP5 with token secured map services.
When creating a web map, using Add->Add Layer From Web, then entering a URL of my rest endpoint with the "Add ArcGIS Web Service" option. ArcGIS Online recognizes the it's a secured service and queries for username and password. Entering u/p, then ArcGIS Online informs me that:
Unable to access the authentication service.
Both my secured map service and my token service are exposed to the internet.
Bottom line is that our organization cannot use ArcGIS online or that I cannot recommend its use to our organization. Unless we can resolve this issue and it does not involve upgrading to ArcGIS 10.1 or 10.2.