Is there anyway to get workflow email alerts to work when sent based on an action from a Sites user?
We have an integration that pushes records into our system via a force.com sites user. We had some automated emails that were being sent by apex and just moved them to workflows so they're easy to configure.
Once we released we noticed we never got any email alerts. I was able to track down a debug log and we're getting the following error
Upsert failed. First exception on row 0; first error: INSUFFICIENT_ACCESS_OR_READONLY, user does not have access to use approval assignment email template: 
What I've done so far
I've done some digging and there are hints that this is a restriction for sites users (see https://salesforce.stackexchange.com/a/46805/594). However, I can't find this limitation documented anywhere.
There also several discussion board entries (i.e. https://developer.salesforce.com/forums/ForumsMain?id=906F000000098XBIAY) of people experiencing this problem, but no solutions.
So far I've tried adjust the email alert from address to the default workflow user, a org wide email address still failing. I've also tried tweaking the email template folder permissions to no avail.
I know I can move the email back into apex triggers which don't seem to have this limit. However, I lose all the configurability of workflow.
Is this really a limitation of Sites users? Is it documented anywhere? This seems like a huge whole in workflow. Technically, I don't see how it's fine for a sites user to send email via apex, but not via workflow.
Are there any tricks to work around this without abandoning workflow?
It appears that this works fine if the email alert is for a standard html template, but not for a visualforce template. Still investigating.