csrfToken: reget without logout user
To get the CSRF Token, do a GET on:

?q=services/session/token


Please note that 'services', is not the path to your endpoint, its a built in path provided by the Services module.

After grabbing the token, you then pass the token along in the header for any POST, PUT, and DELETE requests from authenticated users:

X-CSRF-Token=abcdefg123456789


jDrupal may be of use in this scenario as well, it's a JavaScript API for the Drupal Services module