Could you clarify permissions that are used by SharePoint App?
I see two cases:
There are three kinds of polices:
As I understand these polices is used to access to the host web. But what permissions is used to access app web? Does it use user only permissions? Can I create a list in the app web and send request with app only permissions?
My research on this topic reveals that the Policies apply to the App Web too.I have had an anonymous user (with no permissions) make an entry into a list in the app web. This was achieved through the App Only Policy.
When you are running under the App Only policy, the Current User is changed to the SHAREPOINT\App account which has permissions which were requested during the installation of the App. Whether the user is accessing the host web or the app web should not make much difference as far as the permissions are concerned.
My blog on this topic has some additional details if you like: http://www.vrdmn.com/2013/01/sharepoint-2013-elevate-user-access.html
