A few things:
The method "get_states" should be "getStates" If you're using CSRF tokens (enabled by default), you must pass the CSRF token in the POST request as well, or the request will be denied. I don't see any reason you can't use a GET request instead. The error is in regards to setting a message via setMessage or flashMessage. If you are calling either of these methods, you should pass additional parameters to these methods that indicate the message view is not from your plugin, but from Blesta core instead.
You might take a look at the admin_clients_add.pdt template for an example of fetching states, and use the blestaRequest function for your request instead.