Make dojo xhrRequest work with secured service

Widget.js

/* all this is around line 334 of SQLQuery/Widget.js */

// option 1 is to query the rest endpoint for unique values. 
// option 2 is to store featureSet clientside (1000 limit)
var tokenRequest = esri.id.findCredential(this.activeInfo.fLayerUrl); // THIS IS NEW!
if (!this.activeInfo.featureSet) {
    dojoXhr(this.activeInfo.fLayerUrl + '/query', {
        query: {
            where: '1=1',
            outFields: fieldInfo.name,
            returnDistinctValues: true,
            f: 'json',
            returnGeometry: false, // don't forget to add a comma here...
            token: tokenRequest ? tokenRequest.token : null // THIS IS ALSO NEW!
        },
        headers: {
            'X-Requested-With': null
        },
        handleAs: "json"