I think we should try to bury this scary ISPN-specific logic in a service or something. ideally, I think, the http apis know only about fcrepo-* modules and the JCR API.