User registration through service
Anonymous (and authenticated) users can both get the token from the same place. Try following these steps:


Get the token with a GET to ?q=services/session/token
Attach the token to your POST header under the name X-CSRF-Token
Make the POST call to register the user