Add-in only Authorization and WOPIFRAMEURL

Hi,

I am developing an MVC provider hosted add-in. Documents associated with the add-in are stored in a single on-premises document library.No users of the add-in have any permissions on the library, by design. Instead the add-in permissions have been set to allow app only calls for Write on the library.

1. Can you confirm that using app-only authorization calls,  documents may be added to and deleted from the library? 
2. More importantly, there is a requirement for the user to be able to also View documents in a new browser window. Can you confirm that in an MVC controller, again using app only calls, if I return a redirect to a listitem's wopiframeurl the user will be able to view the document?
3. I think the answer to 2 is Yes. But that would not open the link in a new browser window. The only way to do that is to use JavaScript along the lines of window.open(wopiframeurl). But would that work? Because then that would not open the document using the app only authorization would it?

Many thanks,

Maz

Maz