As the metadata auto-generation is now more thoroughly tested, posting of JSON metadata has been moved up to require update permissions. As the metadata should generally be up to date, this shouldn't affect the user experience of Read only users of projects.