Hi - lt looks like the User Guide incorrectly states that authentication for the remote WMS isnât supported.
"Authentication for the remote WMS isnât supported. The remote WMS must be unsecured."
http://docs.geoserver.org/latest/en/user/data/cascaded/wms.html - http://docs.geoserver.org/latest/en/user/data/cascaded/wms.html
I believe this feature was added as of 2.1.3 - per release notes:
"basic http authentication with cascaded WMS servers"
http://blog.geoserver.org/2011/12/21/geoserver-2-1-3-released/ - http://blog.geoserver.org/2011/12/21/geoserver-2-1-3-released/