Adding preview or marker to the URI causes a 403

If I do this:

private static void DoItViaRest(string containerName, ILogger log)
{
try
{
string uri = string.Format("https://{0}.blob.core.windows.net/{1}?restype=container&comp=list", STORAGE_ACCOUNT_NAME, containerName);
byte[] requestPayload = null;
string xmlString = CallStorageRESTAPI(uri, requestPayload, log).Result;
}
catch (Exception e)
{
// handle exception
}

private static async Task CallStorageRESTAPI(string uri, byte[] requestPayload, ILogger log)
{
string response = string.Empty;

using (var httpRequestMessage = new HttpRequestMessage(HttpMethod.Get, uri) { Content = (requestPayload == null) ? null : new ByteArrayContent(requestPayload) })
{
DateTime now = DateTime.UtcNow;
httpRequestMessage.Headers.Add("x-ms-date", now.ToString("R"));
httpRequestMessage.Headers.Add("x-ms-version", "2017-07-29");
httpRequestMessage.Headers.Authorization = AzureStorageAuthenticationHelper.GetAuthorizationHeader(STORAGE_ACCOUNT_NAME, STORAGE_ACCOUNT_KEY, now, httpRequestMessage);
using (HttpResponseMessage httpResponseMessage = await new HttpClient().SendAsync(httpRequestMessage))
{
if (httpResponseMessage.StatusCode == HttpStatusCode.OK)
{
response = await httpResponseMessage.Content.ReadAsStringAsync();
}
else
{
log.LogInformation(string.Format("REST returned {0}", httpResponseMessage.StatusCode.ToString()));
}
}
}
return response;
}

then the authorization created by AzureStorageAuthenticationHelper.GetAuthorizationHeader(STORAGE_ACCOUNT_NAME, STORAGE_ACCOUNT_KEY, now, httpRequestMessage) works fine.

However if I add prefix or marker to the URI's query string, then I end up with a 403.
Examples with prefix:
https://{0}.blob.core.windows.net/{1}?restype=container&comp=list&prefix={2}
https://{0}.blob.core.windows.net/{1}?restype=container&prefix={2}&comp=list
Examples with marker:
https://{0}.blob.core.windows.net/{1}?restype=container&comp=list&marker={2}
https://{0}.blob.core.windows.net/{1}?restype=container&marker={2}&comp=list