The template composer gets a session from the session pool instead of one obtained with the credentials received from the cms. When the session from the pool does not have the rights to edit the hst configuration, the template composer is not able to make changes to the hst configuration.
This leads to the following warnings in the logs:
10.06.2011 16:52:25 WARN [org.hippoecm.hst.core.container.JCRSessionStatefulConcurrencyValve.invoke():86] For a sessionstatefull jcr session we always expect a jcr session of type 'org.hippoecm.hst.core.jcr.LazySession'. However, there the session is of type '$Proxy22'. We refresh this session now.