X-CSRF-TOKEN ...

index.module.js

(function() {
  'use strict';

  var username = '**********';
  var password = '**********';

  angular
    .module('app', [
      ...
    ])
    .config(function($httpProvider){
      $httpProvider.defaults.headers.common['Authorization'] = btoa(unescape(encodeURIComponent(username + ':' + password)));
    })

.run(['drupal', function(drupal){

      drupal.userLogin(username, password).then(function() {

        alert(drupal.currentUser());
      });

GET http://drupal.lan/user/1 403 (Forbidden)

Accept:*/*
Accept-Encoding:gzip, deflate, sdch
Accept-Language:fr-FR,fr;q=0.8,en-US;q=0.6,en;q=0.4
Connection:keep-alive
Content-type:application/x-www-form-urlencoded
Host:drupal.lan
Origin:http://evil.com/
Referer:http://192.168.50.100:3000/?
User-Agent:Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.99 Safari/537.36