REST interface to custom entity type getting constant 403's
The answer is quite simple but easy to miss.

The URL I used when I made the GET request; http://apps.dev/app/apps_user/1?_format=hal_json is not the same as the URL required to make POST requests. 

To make a POST request, you change it to http://apps.dev/entity/apps_user?_format=hal_json

None of the URL's in the returned _links property are correct for POST requests.