When we use basic authentication to update (PATCH) a record it works fine. Snippet as follows (sorry if this is not clear, seems the insert "code" function does not work on sagecity.com)

var RollUpValue = crm.fields('quot_rollup').value()
var RollUpSQLUpdateValue = ((RollUpValue==true)? 'N' :'Y'); //invert value and send as string
var quoteid = crm.getArg('Key86');
var sid = crm.getArg('sid');
var url = crm.sdata2Url();
url = url + '-/Quotes(\''+quoteid+'\')'

var xhttp = new XMLHttpRequest();
xhttp.onreadystatechange = function() {
if (this.readyState == 4 && this.status == 200) {
alert(this.responseText);
//window.location.reload(true);
}
};

xhttp.open("POST", url, true);
xhttp.setRequestHeader("Content-type", "application/json");
xhttp.setRequestHeader('Authorization', 'Basic ' + '--Base64EncodedUserPass--');
xhttp.send("{\"quot_rollup\":\""+RollUpSQLUpdateValue+"\"}");

When using SID authentication the API returns "BadUrlSyntax". Code snippet:

var RollUpValue = crm.fields('quot_rollup').value()
var RollUpSQLUpdateValue = ((RollUpValue==true)? 'N' :'Y'); //invert value and send as string
var quoteid = crm.getArg('Key86');
var sid = crm.getArg('sid');
var url = crm.sdata2Url();
url = url + '-/Quotes(\''+quoteid+'\')'
url = url + '/?SID='+sid

var xhttp = new XMLHttpRequest();
xhttp.onreadystatechange = function() {
if (this.readyState == 4 && this.status == 200) {
alert(this.responseText);
//window.location.reload(true);
}
};

xhttp.open("POST", url, true);
xhttp.setRequestHeader("Content-type", "application/json");
xhttp.send("{\"quot_rollup\":\""+RollUpSQLUpdateValue+"\"}");

The error returned when using SID authentication in full:

{