How do I do it? I don't -- I only ran the test once, through a massive amount of trickery with a custom browser.
But, to an App, there is no difference between a logged-out user and a user who hasn't installed the App, so I'd use the same basic mechanism for both -- if I can't retrieve your data, I provide a link to the App Profile, and ask the user to either install the App or log in.
Just out of wild curiousity, though, why isn't '-1' consistent? What else are you getting for opensocial_viewer_id from a logged out viewer?