I'm assuming you're referring to the Surf class: org.springframework.extensions.webscripts.connector.RemoteClient ? Are you actually doing anything specific with this class because by the looks of the rest of your post you're just using the WebScript service context to access repository WebScripts. The "slingshot" WebScript you're referenced is specifically designed to be used by the Share application though, so I'm not entirely sure what you're expecting, however using FireBug or Web Developer Tools you should be able to see all the parameters that are passed when Share uses this REST call.
The fact that you're not getting a 401 response at least indicates that whatever you're doing you're authenticating correctly whatever it is you're doing. A bit more information may help us to help you,
Regards,
Dave