[SalesForce] enable the users to customize their home page tab

You can get around the need for a user to have the Customize Application permission if you proxy the custom setting object through another class or properties in your controller. If your VF page is bound directly to an instance of the custom setting, then you get messed up by the custom setting security. I think this is similar to how VF enforces field level security even when the Apex class does not. Here's a gist showing what does and doesn't work: https://gist.github.com/dhoechst/b437230ffd3d0bd6cd02.

My VF page:

<apex:page controller="SuperDuperSettingController">
    <apex:pageMessages />
    <apex:form >
        <apex:pageBlock >
            <apex:pageBlockSection >
                <apex:pageBlockSectionItem >
                    <apex:outputLabel >Name</apex:outputLabel>
                    <apex:inputText value="{!setting.Name}"/>                
                </apex:pageBlockSectionItem>
            </apex:pageBlockSection>
            <apex:pageBlockButtons >
                <apex:commandButton action="{!save}" value="Save" />
            </apex:pageBlockButtons>
        </apex:pageBlock>
    </apex:form>
</apex:page>

And my controller with a proxy class:

public class SuperDuperSettingController {

    public SettingProxy setting {get; set;}

    public SuperDuperSettingController() {
        String settingId = ApexPages.currentPage().getParameters().get( 'id' );
        if (settingId != null ) {
            setting = new SettingProxy([SELECT Id, Name FROM SuperDuperSetting__c WHERE Id = :settingId]);
        } else {
            setting = new SettingProxy();
        }
    }

    public PageReference save() {
        if (setting.Id != null) {
            update setting.getSuperDuperSetting();
        } else {
            setting.insertSetting();
        }
        PageReference pr = Page.SuperDuperSetting;
        pr.getParameters().put('Id', setting.Id);
        pr.setRedirect(true);
        return pr;
    }

    public class SettingProxy {
        public Id Id {get;set;}
        public String Name {get;set;}

        public SettingProxy(SuperDuperSetting__c sdp) {
            this.Id = sdp.Id;
            this.Name = sdp.Name;
        }

        public SettingProxy() {}

        public SuperDuperSetting__c getSuperDuperSetting() {
            return new SuperDuperSetting__c(
                Id = this.Id,
                Name = this.Name
            );
        }

        public void insertSetting() {
            SuperDuperSetting__c sdp = this.getSuperDuperSetting();
            insert sdp;
            this.Id = sdp.Id;
        }

    }
}

This permission is under the App Permissions section.