[Mayan EDMS: 2326] Unable to add metadata value via the API

[RW Shore]

I'm trying to add a metadata value to a specific document via the REST API.
Mayan itself is running in a docker comtainer; the image is the latest (as
of a couple of days ago) NG version. I've registered a response filter that
dumps stuff from the request and response; this is what I see
------------------------------------
===== Client request context =====
Acceptable languages: [*]
Acceptable media types: [application/json]
Cookies: {}
Date: null
Headers: {Accept=[application/json], Content-Type=[application/json],
Authorization=[Basic c2hvcmU6VFZPUl9wYXNzd29yZDoyNDE5],
User-Agent=[Jersey/2.26 (HttpUrlConnection 1.8.0_161)]}
Language: null
Media type: application/json
Property names: [org.glassfish.jersey.client.authentication.
HttpAuthenticationFilter.operation]
Request method: POST
URI: http://mayan.tvor.support:29880/api/metadata/documents/11/metadata
Entity: NewMayanMetadataValue [metadata_type_pk=80, value=8 bits]
Entity annotations: [Ljava.lang.annotation.Annotation;@5ef8df1e
Entity class: class tvor.extractor.exif.data.NewMayanMetadataValue
Entity type: class tvor.extractor.exif.data.NewMayanMetadataValue

===== Client response context =====
Allowed methods: []
Cookies: {}
Date: Thu Mar 08 10:37:31 EST 2018
Entity tag: null
Headers: {Transfer-Encoding=[chunked], X-Frame-Options=[SAMEORIGIN],
Server=[nginx/1.10.3 (Ubuntu)], Connection=[keep-alive],
Vary=[Accept-Language, Cookie], Date=[Thu, 08 Mar 2018 15:37:31 GMT],
Content-Language=[en], Content-Type=[text/html; charset=utf-8]}
Language: en
Last modified: null
Length: -1
Links: []
Location: null
Media type: text/html;charset=utf-8
Status: Forbidden
Status: 403
----------------------------------------

Now, the userid that's embedded in the authentication header is in a group
that's in a role that has all privileges. Furthermore, this user is able to
create new metadata types programatically, with no problem, which indicates
that I haven't mess up the userid or password. All the PKs are good,
because I can use the Swagger UI to do this same insert, and it works.
(yes, I also check to ensure that I'm not inserting a new value for a
metadata field that's already attached to the document).

So, there must be something different about the way that my Java code is
using this specific API function as opposed to the way that the Swagger UI
is using it.

I can't find any logs that might indicate exactly what's causing the
"forbidden" response. Anybody have any ideas?