RED.httpNode.get gives "Unauthorized"

You should not be using the needsPermission middleware on RED.httpNode.

needsPermission is for the admin apis - in other words routes that are mounted on RED.httpAdmin.