Headless Drupal 8 - cookie authentication
It looks like maybe you are not successfully retrieving the CSRF token. The CSRF token can be retrieved from /rest/session/token. 

See https://www.drupal.org/docs/8/core/modules/rest/3-post-for-creating-content-entities for examples on POSTing to core entity endpoints.