btw, I say "I don't think..." because of this quote from NS Help:

For a RESTlet called from a client hosted by NetSuite, you do not need to pass authentication information in the HTTP request. A check for all valid NetSuite session cookies occurs, and this existing session is reused.