If a user changes a variable then its new content is stored as part of the users setting in that app. Which means that the variable your changing is not globally changed. That how QlikView used to work. Variables in Sense are not editable when published.
I would guess that in a later release, the ability to change variable for end users will appear. But right now published apps don't have access to variables, in the same way as "my work" apps have.
It also sounds right to me that you cannot change or save an app that is published. The save method implies that a change in layout or datamodel has occured. These changes cannot be done for published apps, only "my work".
What you could do is, duplicate the app, make the change, and published it again. This offcourse requires the user to have permissions to do this.
Otherwise, you could set the variable in the script, based on a external file, which you can update from the mashup and then reload it.
I hope this helps.
The default security rules will prevent you from saving a published app. However you can change those rules but it's at your own risk since if two people save the app at the same time we have no way of determining when changes override each other. For example, user A is working on a chart. User B then calls app.save(), user A looses his chart.