if you're using user credentials, i'm pretty certain you have to provide the account and role in the NLAUTH header specifically. You can't pass them in as URL parameters.