Is this trying to modify JCR state in the context of a GET request and potentially on publish, where it wont have write permissions?

Anything modifying data in a meaningful way should be associated w a non-safe (POST); GETs are meant to be idempotent.