on-premise sharepoint hosted app, anonymous access

I have been wrestling with a permissions issue. The app has been installed in sharepoint, I have gone through all the permission settings for anonymous access so I am 90% sure it is all correct. So, no I am looking at the actual app code now...

This is an image carousel app that rotates through images defined in a document library. The site is available to the public without logging in.

Is the code below correct?

        executor.executeAsync(
        {
            url:
                spAppUrl +
                "/_api/SP.AppContextSite(@target)/web/lists/getbytitle('" + imageListName + "')/items?" + 
                "$select=EncodedAbsUrl, *&" +
                "@target='" + spHostUrl + "'",
            method: "GET",
            headers: { "Accept": "application/json; odata=verbose" },
            success: function (data) {
                // Clear the current items.
                $('#carouselAppMain .carousel-inner').empty();
                // Unpack the body into a usable object
                var result = JSON.parse(data.body);
                // Add this to the ul for the carousel.
                // Set a variable for the active item.
                var active = "active";
                var count = 0;
                // Loop through the items. 
                for (var i in result.d.results) {
                    var item = result.d.results[i];
                    // See if it is selected.
                    if (!('Include' in item) || item.Include) {
                        // Add some title text
                        var title = "";
                        if ('Title' in item && item.Title){
                            title = 
                                '<div class="carousel-caption">' +
                                '  <h4>' + item.Title + '</h4>' +
                                '</div>';
                        }
                        // Add the item to the list
                        $('#carouselAppMain .carousel-inner').append(
                            '<div class="item ' + active + '">' +
                            '  <img src="' + item.EncodedAbsUrl + '" ' +
                            '  alt="">' + 
                            '  ' + title +
                            '</div>'
                        );
                        // Add the navitator
                        $('#carouselAppMain .carousel-indicators').append(
                            '<li data-target="#carouselAppMain" ' +
                            'data-slide-to="' + count + '" ' +
                            'class="' + active + '" ' +
                            '></li>'
                        );

                        active = "";
                        count++;
                    }
                }
                setUpCarousel();
            },
            error: function (data, errorCode, errorMessage) {
                $('#carouselAppMain .carousel-inner').empty();
                $('#carouselAppMain .carousel-inner').append(
                    '<div class="item active">' +
                    'Error accessing...' +
                    '</div>'
                );

                setUpCarousel();
            }
        }

App manifest permissions:

<AppPermissionRequests AllowAppOnlyPolicy="true">
    <AppPermissionRequest Scope="http://sharepoint/content/sitecollection/web/list" Right="Read" />
    <AppPermissionRequest Scope="http://sharepoint/content/sitecollection/web" Right="Read" />
</AppPermissionRequests>

Something is forcing me to be logged in for the carousel to work...

Update:

I am trying to follow the following:

http://ift.tt/1BmlBH0

Since I already set the site to allow anonymous I did the following:

• I removed the app from the app catalog, site content and from the page itself.


• I went to central admin, Manage web applications, clicked on site, went to authentication providers, unchecked Enable Anonymous


• reset iis to be safe


• reinstalled the app to app catalog


• added and trusted the app to site content


• I went to central admin, Manage web applications, clicked on site, went to authentication providers, checked Enable Anonymous

Still to no avail. Still required to login...

I even tried unchecking "Require Use Remote Interfaces Permission"...

To no avail.

What am I not understanding about the "/_api/SP.AppContextSite(@target)/web/lists/getbytitle('".. call?

I have confirmed that the document library/image list is available anonymously.

I am pretty sure that it has something to do with the API call. Is there a different call I can make anonymously?