tries GIS tier (token) then web tier authentication for secured AGS