You aren't considered "authenticated" on the backend for some reason so there's no valid session to validate you're logged in which is why it has to be available without login. Most likely its the same reason you can't call a suitelet from a serverside script unless its marked "availabie without login".