In theorie, API methods are call from a code ( and not directly as a normal webpage on a web browser.)
When you write code to make api call, generaly (except a specific requirement ) you did not setup the "User-Agent".
In your case the User Agent is added on your web browser side.
So it is possible that Poloniex double check "User-Agent" in order to ban not conventional browser ... probably to avoid DDOS.
Last news has confirmed that some fake poloniex android app was stealing API secret and key, so it is potentialy a security feature setup in response to this treat by Poloniex to avoid definitly that "malware" android app could act on wallet without the user permission.
If it is not relative to anti-ddos process it could be relative to mobile ISP applying filter or doing MIM for security.