You aren't authenticated at the server-side which is why it doesn't work... depending on what you're trying to do there's probably a decent approach to avoid the suitelet.