Have SharePoint 2013 with a provider hosted add-in hosted internally (not Azure,etc). I gave the app Full Control permissions on the site collection. It is basically the Visual Studio 2015 SharePoint Web Forms app with no modifications.
The Host site in SharePoint has "Everyone" given full read permissions.
I simply published the Add-In to a local IIS site. I then constructed the add-in url passing it a valid SPHostUrl of the SP site where the app was installed. Things are working fine, as long as the user that accesses the add-in site has also visited the SPHostUrl site. If the user has not visited the SPHostUrl site, the call to load the Web title fails with a 401 Unauthorized.
Is this a limitation of the Add-In model? Can I not access the SPHostUrl by way of provider hosted add-in if I have not actually visited the SharePoint site (or have a /catalogs/user entry there)?