You can use CORS in a packaged app to talk to your own web service http://en.wikipedia.org/wiki/Cross-origin_resource_sharing or you need XHR permissions such as
"permissions": { "systemXHR": {} }
https://developer.mozilla.org/en-US/docs/Apps/App_permission... Some info