The read and read/write permission level is stored on a per-token
basis. This is to prevent a user from authorizing your application as
"read only" and you escalating it to "read and write" without their
knowledge. You need to get a new token for the user in question to be
able to write. You can also pass the oauth_access_type parameter in
the user redirect [1] to specify.
Thanks;
– Matt Sanford / @mzsanford
Twitter Dev
[1] - http://groups.google.com/group/twitter-development-talk/browse_frm/thread/d4fefae61f5e7019