Where did you get your accessToken from? If you used OAuth to establish the session then you will need to have the web OAuth scope to use the sessionid for what is essentially a screen scraping web request. Having the api scope would be sufficient for the Partner API, but for for mocking UI requests.
Other than that, as you have found, you need to put the sessionId/accessToken into a sid cookie along with the request.
You can check your OAuth Scopes under
Setup > App Setup > Create > Apps > [App Name].
It should appear next to Selected OAuth Scopes.
When calling /services/oauth2/authorize I'm using response_type=Token. I'm also passing a scope query string parameter that includes web. So I've specified the web scope on both the App and when initiating the OAuth process.
It appears you are using the Web Server OAuth Authentication Flow. The scope parameter is applicable here as well.
scope
Specifies what data your application can access. See “Scope Parameter Values” in the online help for more information.