ERROR #5540: SQLCODE: -99 Message: User UnknownUser is not privileged for the operation

I am working on iris-for-money app: https://github.com/oliverwilms/iris-for-money

Account.csp posts a rest call with _SYSTEM username and the password.

xhttp.open("POST", "/restapi/sql/" + query, true,"_SYSTEM","SYS");
xhttp.send();

The error is logged in Riches.REST for this line:

Set tSC = tStatement.%Prepare(pQuery)

ClassMethod PostSQL(pQuery As %String = "", pIndex As %String = -1) As %Status
{
    Do ..DebugTEST("Riches.REST - PostSQL")
    Do ..DebugTEST("pQuery = "_pQuery)
    Set tSC = ..TestQuery(pQuery,.pQuery)
    Do ..DebugTEST("TestQuery = "_pQuery)
    Set tStatement = ##class(%SQL.Statement).%New()
    Set tSC = tStatement.%Prepare(pQuery)
    If $$$ISERR(tSC) {
        Do ..DebugStatus(tSC)
        Write "%Prepare failed:"
        Do $System.Status.DisplayError(tSC) // QUIT
    } Else {
        #Dim rset As %SQL.StatementResult
        // Execute the current statement and return the result. The result of the execute is always the return value.
        // Success/Failure information is reported in the result object as %SQLCODE, %Message, %ROWCOUNT, and/or %ROWID.
        Set rset = tStatement.%Execute()
        Do ..DebugTEST("%SQLCODE = "_rset.%SQLCODE)
        Do ..DebugTEST("%Message = "_rset.%Message)
        Do ..DebugTEST("%ROWID = "_rset.%ROWID)
    }
    Quit tSC
}

Why does the code fail with UnknownUser error when the request has _SYSTEM username and a password?