Working with ESRI, they identified a bug using Web Tier authentication, so at their recommendation I changed to GIS Server authentication. I have differing behaviors now depending on if the map is public or private and if it is running in Portal or as a Javascript web app, built with the Web App Builder.
If the features are public and the map or app is public it all works as advertised in Portal or web app.
If the features are private and the Portal map is restricted it all works as advertised in Portal.
If the features are private and the Portal map is restricted and it is published using web app builder (either through Portal or developer), when opened via web app, it will let me edit/move my own features and won't let me move or edit others'; however it will let me delete anyone's features. It appears to be a bug in the "Edit" widget because the Portal instance of the map works as it should, only after publishing, via app builder, and using the "Edit" widget does it allow deletions of anyone's features.