fetch('http://blt.dev/session/token')
  .then(
    function(response) {
      if (response.status !== 200) {
        console.log('Looks like there was a problem. Status Code: ' +
          response.status);
        return;
      }

      // Examine the text in the response
      response.text().then(function(data) {
        console.log(data);
      });
    }
  )
  .catch(function(err) {
    console.log('Fetch Error :-S', err);
  });

fetch('http://blt.dev/api/v1/token?_format=hal_json', {
     method: 'POST',
     credentials: 'include',
     headers: {
       'Content-Type': 'application/hal+json',
       'X-CSRF-Token': 'GVRpRLO_GkJbPRd00JEfvXP7ycSIP4UYR766zuGchRc',
       'Authorization': 'json_auth'
     },
     body: JSON.stringify({ username: 'admin', password: 'admin' })
   })
   .then(function(response){
      if(!response.ok){
        throw Error(response.statusText);
      }
      return response;
   })
   .then(function(response){
      return response.json()
   })
   .then(response => {
     try {
      console.log(response.token)
       return response.token;
     } catch (e) {
       console.log(e);
     }
   })
   .catch(error => {
     console.log(error);
   });

Error: Forbidden
    at <anonymous>:13:15
    at <anonymous>