I have just released 1.4.7 of the release notes VSTS extension. This provides a new advanced options that allows you to switch the authentication model.
The default remains the same i.e. use a personal access token provided by the server, but you have the option to enable use of the ‘defaultcredentials’ (via the advanced properties). If this is done the account the build agent is running as is used. Hopefully this should fix the 401 issues some people have been seeing when using the task with on-prem TFS.
For most people the default PAT model should be fine