Login via REST fails (403 forbidden) if cookie set by Drupal is kept
Can authenticated users not use the login url anymore?


No they can't, it wouldn't make sense for them to be able to (you can't login if you're already logged in).

In practical terms, this is the routing entry for the login endpoint:

user.login:
  path: '/user/login'
  defaults:
    _form: '\Drupal\user\Form\UserLoginForm'
    _title: 'Log in'
  requirements:
    _user_is_logged_in: 'FALSE'
  options:
    _maintenance_access: TRUE


As you can see from the requirements, the user cannot already be logged in to access the resource.