Problems with Services and CSRF token
For future users, there's a bunch of confusing examples out there. Based on the above link example this is my working setup:

URL: /rest/user.json

Headers:

"X-CSRF-Token":"fsddfhbusoibdfbdsbfoubewbfw"
"Content-Type":"application/json"


Body:

{
 "name":"username",
 "pass":"password",
 "mail":"email",
 "field_user_full_name":{"und":[{"value":"CHECK1 n CHECK2"}]},
 "roles":[4],
 "status":"1",
 "language":"und"
}