How do you access data in an app web from the host web?

How do you access data in an app web from the host web using JavaScript / CSOM? Note, the JavaScript is not being executed from within an app part -- this would be easy :)

A trivial example:

• You install an app
• The app provisions a list in its app web
• You add a Script Editor Web Part to a page on the host web, and want to JS to display the app's list items

There's a couple of obvious challenges in this scenario:

• The ~appWebUrl token cannot be used outside the context of an app part, so we don't have an easy way of determining the app web URL
• The host web and / or app web would need to support CORS since the app web doesn't use the same domain (e.g.app-xxxxxxxx.sharepoint.com)
• The browser session would require a cookie authenticated for the app web (I assume this is handled by_layouts/15/appredirect.aspx when you access the app via Site Contents)

Any ideas? MS provides some code samples for app web -> host web JavaScript calls, but not the other way around.