I ran into the same problem trying to build a custom html module that contained and http request. Worked fine when I was logged in as an admin but not as a regular user. The trick is to not depend on ServicesFramework at all. Just pretend it isn't there. All you need for a http request in dnn is the ModuleId and the TabId. In your ascx you can load these id's to the page like:

<%=ModuleContext.ModuleId %>
<%=ModuleContext.TabId%>

In my script I hard coded these values for testing as I'm using only html. My code:

angular.module('HtmlModule.factories', [])
.factory('Factory', ['$resource', function($resource) {
var self = this;

self.moduleId = 419;
self.tabId = 41;

self.headers = {
'Content-Type': 'application/json',
'ModuleId': self.moduleId,
'TabId': self.tabId
}


if ($.ServicesFramework) {
var sf = $.ServicesFramework(self.moduleId);
self.headers.RequestVerificationToken = sf.getAntiForgeryValue();
self.headers.TabId = sf.getTabId();
}

return $resource('/DesktopModules/PROJECT/Api/CONTROLLER/METHOD', {}, {
retrieve: {
method: 'GET',
headers: self.headers
}
});
}]);

That works!