or is that RESTlet only?

restlets only. You need to be authenticated to access a suietlet OR available without login.

thanks for confirming @creece. Wish it weren't so (i.e that suitelets would support TBA for auth)