rest POST via Postman always ends in 403 access denied
Your request need ?_format=json on the end of request.
Clear cache.
Delete all sessions, delete from sessions.
Call login service, /user/login?_format=json, 
method POST 
choose raw in Body and there put username and password in JSON format:

{
   "username": "value",
   "password": "value",
}


and choose JSON (application/json).

This service will return X-CSFR-TOKEN, use it for your request.