Not because of ACLs, but because request.getParameter() is returning the *page content without edits*. This should NOT be happening.
Looks like our Javascript is inserting an extraneous <textarea> without an id, and putting the edit content in it. Ugh. Hard to debug.
/Janne
