switched from SecurityDisabler to UserSwitcher, and now requiring a username in the XML file
put the parent.Add in a try-catch block, to return an empty list on the AccessDeniedException
now I can create media items.