Drupal service session handling
For any POST, PATCH or DELETE request, you always need to pass along the X-CSRF-Token.

After logging in via REST, the new X-CSRF-Token should be provided in that data result, then you can just set that aside (in a global variable, in local storage, etc) and then pass it along with each request.

I personally use (and created) this module to make things easier: https://www.drupal.org/project/angular_drupal