If I get some time, I will try to document this in detail but the overall solution is outlined above. The key thing is using the proxy.ashx and proxy.config files supplied by ESRI, and enabling proxy usage in your Flex widgets. Then all map service requests are passed via the proxy.ashx file where you can verify user authentication, request a token, and pass on the requests to ArcGIS Server.