With

<identity impersonate = "true" />

the app runs under the current user's security role.

Perhaps you should set it to false.