Found this in the help center: Additionally, 

nlapiRequestURL

 calls from server-side scripts do not include the current user's session information. This means you can only use this API to request Suitelets that are set to available without login using the external URL. Note that calls from client scripts do persist session information.