Rest login cookie token explanation
You are logging in correctly by POSTing the username and password. After you've logged in, a Drupal session is created.

The csrf_token can be used to authorise future requests requests by sending it as a header:

X-CSRF-Token: XXXXXR5HQwidW7CKIDL52tOg4JGKi7Pa-j87KKlr8Mg


You can send this instead of a cookie if you've configured the backend to allow it. I've only used the CORS contrib module as CORS in Drupal core doesn't have the same flexibility.


  I understand that the logout token is used with /user/logout in order
  remove the cookie and log the user out.


Correct.

Also see my answer here: https://drupal.stackexchange.com/a/235712/34673