Where did you get your accessToken from? If you used OAuth to establish the session then you will need to have the `web` OAuth scope to use the sessionid for what is essentially a screen scraping web request. Having the `api` scope would be sufficient for the Partner API, but for for mocking UI requests.

![enter image description here][1]

Other than that, as you have found, you need to put the sessionId/accessToken into a `sid` cookie along with the request.

----

You can check your OAuth Scopes under 
 > Setup > App Setup > Create > Apps > [App Name].

 It should appear next to Selected OAuth Scopes.

When calling `/services/oauth2/authorize` I'm using `response_type=Token`. I'm also passing a scope query string parameter that includes `web`. So I've specified the web scope on both the App and when initiating the OAuth process.

It appears you are using the [Web Server OAuth Authentication Flow][2] (based on the response_type=code). The scope parameter is applicable here as well.

 > **scope**  
Specifies what data your application can access. See “[Scope Parameter Values][3]” in the online help for more information.

So you try modifying the authUrl line:

    authUrl = environment + "/services/oauth2/authorize?response_type=code&client_id=" + clientId +
     "&redirect_uri=" + URLEncoder.encode(redirectUri, "UTF-8") +
     "&scope=full%20web";

Once you have a sessionId/accessToken, you can verify that it is valid for a web session in a browser using

    https://<instanceUrl>/secur/frontdoor.jsp?sid=<accessToken>"

This should bounce you into a browser session with the sid cookie set. If it doesn't work, the session isn't valid for the web, which you will need to screenscrape an image via `servlet/rtaImage`.


  [1]: https://i.sstatic.net/jzzuP.png
  [2]: http://www.salesforce.com/us/developer/docs/api_rest/Content/intro_understanding_web_server_oauth_flow.htm
  [3]: https://help.salesforce.com/HTViewHelpDoc?id=remoteaccess_oauth_scopes.htm&language=en_US