I have taken the following steps:
When the real-world friends try running the app, they get 404 errors
"the requested URL was not found on this server" when it tries loading "https://apps-APP_ID.apps.fbsbx.com/hosted-canvas/e30=/.
I am using Facebook's Simple Application Hosting. The url for the app is "https://apps.facebook.com/APP_ID". When the admin hits this it works fine, when the Tester hits it they get the error. Some have suggested that there is a sandbox setting that needs to be turned off, but I see no such thing in any of the settings on the Dashboard. Any insights you could offer would be greatly appreciated.
Not sure if it helps anyone figure it out, but the app consists only of a data file, a Javascript file (xxx.js), and an index.html.
Holy moly - alright I'm hoping this helps someone else out. Apparently, when you create an app, and then create a test app so that you can establish a dev environment for testing - which is standard procedure - you have to add any testers to the parent (production) app under "Roles". I was only adding it under "Roles" for the test app, which apparently is not enough. If anyone from Facebook is reading this, please update your docs, or update the dashboard to issue a warning to people who only add testers under the test app.