Shopping cart should be stored in system context to avoid AccessDeniedException. For more details MSHOP-156